diff --git a/DevProxy.Abstractions/Proxy/IProxyConfiguration.cs b/DevProxy.Abstractions/Proxy/IProxyConfiguration.cs
index 4d46bfc15..d30ebed8f 100644
--- a/DevProxy.Abstractions/Proxy/IProxyConfiguration.cs
+++ b/DevProxy.Abstractions/Proxy/IProxyConfiguration.cs
@@ -29,6 +29,7 @@ public enum OutputFormat
 public interface IProxyConfiguration
 {
     int ApiPort { get; set; }
+    string ApiIpAddress { get; set; }
     bool AsSystemProxy { get; set; }
     string ConfigFile { get; }
 #pragma warning disable CA2227
diff --git a/DevProxy.Integration.Tests/TestProxyConfiguration.cs b/DevProxy.Integration.Tests/TestProxyConfiguration.cs
index 86126d18d..9733939f7 100644
--- a/DevProxy.Integration.Tests/TestProxyConfiguration.cs
+++ b/DevProxy.Integration.Tests/TestProxyConfiguration.cs
@@ -15,6 +15,7 @@ namespace DevProxy.Integration.Tests;
 /// </summary>
 internal sealed class TestProxyConfiguration : IProxyConfiguration
 {
+    public string ApiIpAddress { get; set; } = "127.0.0.1";
     public int ApiPort { get; set; }
     public bool AsSystemProxy { get; set; }
     public string ConfigFile { get; set; } = "devproxyrc.json";
diff --git a/DevProxy.Tests/ConsoleHotkeyHandlerTests.cs b/DevProxy.Tests/ConsoleHotkeyHandlerTests.cs
index 53a15455d..b83af21ec 100644
--- a/DevProxy.Tests/ConsoleHotkeyHandlerTests.cs
+++ b/DevProxy.Tests/ConsoleHotkeyHandlerTests.cs
@@ -15,11 +15,11 @@ namespace DevProxy.Tests;
 public sealed class ConsoleHotkeyHandlerTests
 {
     private static (ConsoleHotkeyHandler handler, FakeProxyStateController controller, RecordingConsole console)
-        CreateHandler(OutputFormat output = OutputFormat.Text, string ipAddress = "127.0.0.1")
+        CreateHandler(OutputFormat output = OutputFormat.Text, string apiIpAddress = "127.0.0.1")
     {
         var controller = new FakeProxyStateController();
         var console = new RecordingConsole();
-        var configuration = new FakeProxyConfiguration { Output = output, IPAddress = ipAddress };
+        var configuration = new FakeProxyConfiguration { Output = output, ApiIpAddress = apiIpAddress };
         var handler = new ConsoleHotkeyHandler(controller, configuration, console);
         return (handler, controller, console);
     }
@@ -119,10 +119,14 @@ public void PrintApiInstructions_WritesAllApiCommands()
         handler.PrintApiInstructions();
 
         var joined = string.Join('\n', console.Lines);
+        Assert.Contains("Authorization: Bearer <token>", joined, StringComparison.Ordinal);
         Assert.Contains("/proxy/mockRequest", joined, StringComparison.Ordinal);
-        Assert.Contains("\\\"recording\\\": true", joined, StringComparison.Ordinal);
-        Assert.Contains("\\\"recording\\\": false", joined, StringComparison.Ordinal);
+        Assert.Contains("\\\"recording\\\":true", joined, StringComparison.Ordinal);
+        Assert.Contains("\\\"recording\\\":false", joined, StringComparison.Ordinal);
         Assert.Contains("/proxy/stopProxy", joined, StringComparison.Ordinal);
+        var result = Assert.Single(console.Lines, line => line.Contains("\"type\":\"result\"", StringComparison.Ordinal));
+        Assert.DoesNotContain('\n', result);
+        Assert.Contains("\"category\":\"ProxyEngine\"", result, StringComparison.Ordinal);
     }
 
     [Fact]
@@ -142,7 +146,7 @@ public void PrintApiInstructions_NormalizesIpv6WildcardAddress()
 
         handler.PrintApiInstructions();
 
-        Assert.Contains(console.Lines, line => line.Contains("http://127.0.0.1:8897/proxy", StringComparison.Ordinal));
+        Assert.Contains(console.Lines, line => line.Contains("http://[::1]:8897/proxy", StringComparison.Ordinal));
     }
 
     [Fact]
diff --git a/DevProxy.Tests/Fakes.cs b/DevProxy.Tests/Fakes.cs
index 6913784c9..68b853827 100644
--- a/DevProxy.Tests/Fakes.cs
+++ b/DevProxy.Tests/Fakes.cs
@@ -65,11 +65,12 @@ internal sealed class RecordingConsole : ISystemConsole
 }
 
 /// <summary>
-/// Minimal <see cref="IProxyConfiguration"/>; only Output/IPAddress/ApiPort/Record
+/// Minimal <see cref="IProxyConfiguration"/>; only Output/ApiIpAddress/ApiPort/Record
 /// are read by the interactive console, the rest carry inert defaults.
 /// </summary>
 internal sealed class FakeProxyConfiguration : IProxyConfiguration
 {
+    public string ApiIpAddress { get; set; } = "127.0.0.1";
     public int ApiPort { get; set; } = 8897;
     public bool AsSystemProxy { get; set; }
     public string ConfigFile { get; set; } = "devproxyrc.json";
diff --git a/DevProxy/ApiSecurity.cs b/DevProxy/ApiSecurity.cs
new file mode 100644
index 000000000..d20e3a7fb
--- /dev/null
+++ b/DevProxy/ApiSecurity.cs
@@ -0,0 +1,138 @@
+using DevProxy.State;
+using System.Net.Http.Headers;
+using System.Security.Cryptography;
+using System.Text;
+
+namespace DevProxy;
+
+internal static class ApiSecurity
+{
+    private static readonly string Token = Convert.ToHexString(RandomNumberGenerator.GetBytes(32));
+    private static readonly byte[] TokenBytes = Encoding.UTF8.GetBytes(Token);
+    private static bool _tokenDisplayed;
+
+    public static bool ShouldDisplayToken => Environment.GetEnvironmentVariable("CI") is null;
+    public static string? DisplayToken => ShouldDisplayToken ? Token : null;
+
+    public static void LogTokenOnce(ILogger logger)
+    {
+        if (!ShouldDisplayToken || _tokenDisplayed)
+        {
+            return;
+        }
+
+        _tokenDisplayed = true;
+        logger.LogInformation("API token: {ApiToken}", Token);
+        logger.LogInformation("Send this token in the Authorization: Bearer header.");
+    }
+
+    public static string[] GetAllowedOrigins(IConfiguration configuration)
+    {
+        var origins = configuration.GetSection("apiAllowedOrigins").Get<string[]>() ?? [];
+        foreach (var origin in origins)
+        {
+            if (!Uri.TryCreate(origin, UriKind.Absolute, out var uri) ||
+                (uri.Scheme != Uri.UriSchemeHttp && uri.Scheme != Uri.UriSchemeHttps) ||
+                uri.UserInfo.Length != 0 || origin.Contains('*', StringComparison.Ordinal) ||
+                !string.Equals(origin, uri.GetLeftPart(UriPartial.Authority), StringComparison.Ordinal))
+            {
+                throw new InvalidOperationException("apiAllowedOrigins must contain exact HTTP or HTTPS origins without paths, wildcards, or trailing slashes.");
+            }
+        }
+
+        return origins;
+    }
+
+    public static async Task CheckOriginAsync(HttpContext context, Func<Task> next, string[] allowedOrigins)
+    {
+        context.Response.Headers.CacheControl = "no-store";
+        if (context.Request.Headers.TryGetValue("Origin", out var origin) &&
+            !allowedOrigins.Contains(origin.ToString(), StringComparer.Ordinal))
+        {
+            context.Response.StatusCode = StatusCodes.Status403Forbidden;
+            return;
+        }
+
+        await next();
+    }
+
+    public static string GetTokenFilePath(int pid) =>
+        Path.Combine(StateManager.GetConfigFolder(), "credentials", $"api-{pid}.token");
+
+    public static string GetApiUrl(Microsoft.AspNetCore.Hosting.Server.IServer server, int fallbackPort) =>
+        GetApiUrl(server.Features.Get<Microsoft.AspNetCore.Hosting.Server.Features.IServerAddressesFeature>()?.Addresses.FirstOrDefault()
+            ?? $"http://127.0.0.1:{fallbackPort}");
+
+    public static string GetApiUrl(string url)
+    {
+        var address = new UriBuilder(url);
+        address.Host = address.Uri.IdnHost switch
+        {
+            "0.0.0.0" => "127.0.0.1",
+            "::" => "::1",
+            _ => address.Host
+        };
+        return address.Uri.GetLeftPart(UriPartial.Authority);
+    }
+
+    public static Task SaveTokenAsync(CancellationToken cancellationToken = default)
+    {
+        PrivateFiles.EnsureDirectory(StateManager.GetConfigFolder());
+        PrivateFiles.EnsureDirectory(Path.GetDirectoryName(GetTokenFilePath(Environment.ProcessId))!, secureExisting: true);
+        return PrivateFiles.WriteAllTextAsync(GetTokenFilePath(Environment.ProcessId), Token, cancellationToken);
+    }
+
+    public static async Task<HttpClient> CreateClientAsync(ProxyInstanceState state, TimeSpan timeout, CancellationToken cancellationToken)
+    {
+        if (!Uri.TryCreate(state.ApiUrl, UriKind.Absolute, out var address) ||
+            address.Scheme != Uri.UriSchemeHttp ||
+            !System.Net.IPAddress.TryParse(address.IdnHost, out _))
+        {
+            throw new InvalidOperationException("The Dev Proxy API address must be an HTTP IP address.");
+        }
+
+        var token = (await File.ReadAllTextAsync(GetTokenFilePath(state.Pid), cancellationToken)).Trim();
+        var authorization = new AuthenticationHeaderValue("Bearer", token);
+#pragma warning disable CA2000
+        var handler = new HttpClientHandler
+        {
+            UseProxy = false,
+            AllowAutoRedirect = false,
+            CheckCertificateRevocationList = true
+        };
+#pragma warning restore CA2000
+        try
+        {
+            var client = new HttpClient(handler, disposeHandler: true)
+            {
+                BaseAddress = address,
+                Timeout = timeout
+            };
+            client.DefaultRequestHeaders.Authorization = authorization;
+            return client;
+        }
+        catch
+        {
+            handler.Dispose();
+            throw;
+        }
+    }
+
+    public static async Task AuthenticateAsync(HttpContext context, Func<Task> next)
+    {
+        var authorization = context.Request.Headers.Authorization.ToString();
+        const string prefix = "Bearer ";
+        if (authorization.Length != prefix.Length + Token.Length ||
+            !authorization.StartsWith(prefix, StringComparison.OrdinalIgnoreCase) ||
+            !CryptographicOperations.FixedTimeEquals(
+                Encoding.UTF8.GetBytes(authorization[prefix.Length..]), TokenBytes))
+        {
+            context.Response.StatusCode = StatusCodes.Status401Unauthorized;
+            context.Response.Headers.WWWAuthenticate = "Bearer";
+            return;
+        }
+
+        context.Response.Headers.CacheControl = "no-store";
+        await next();
+    }
+}
\ No newline at end of file
diff --git a/DevProxy/Commands/ApiCommand.cs b/DevProxy/Commands/ApiCommand.cs
index 909bf9e4a..78119ddce 100644
--- a/DevProxy/Commands/ApiCommand.cs
+++ b/DevProxy/Commands/ApiCommand.cs
@@ -4,6 +4,7 @@
 
 using DevProxy.Abstractions.Proxy;
 using DevProxy.Abstractions.Utils;
+using DevProxy.State;
 using Microsoft.Extensions.Logging;
 using System.CommandLine;
 using System.CommandLine.Parsing;
@@ -33,17 +34,94 @@ private void ConfigureCommand()
             PrintApiInfo(outputFormat);
         });
 
+        var apiTokenCommand = new Command("token", """
+            Print the API token of a running Dev Proxy instance.
+
+            Examples:
+              devproxy api token
+              devproxy api token --pid 12345
+              devproxy api token --output json
+
+            Selects the only running instance. With multiple instances, specify --pid.
+            Reads credentials for the current user; Dev Proxy must already be running.
+            Prints the secret to stdout, including when redirected. Errors go to stderr.
+            JSON output: { "pid": number, "apiUrl": string, "token": string }.
+            Exit codes: 0 success, 1 instance/credential unavailable, 2 invalid arguments.
+            """);
+        var pidOption = new Option<int?>("--pid")
+        {
+            Description = "Retrieve the token of a specific Dev Proxy instance"
+        };
+        apiTokenCommand.Add(pidOption);
+        apiTokenCommand.SetAction(async (parseResult, cancellationToken) =>
+        {
+            var outputFormat = parseResult.GetValueOrDefault<OutputFormat?>(DevProxyCommand.OutputOptionName) ?? OutputFormat.Text;
+            return await PrintTokenAsync(parseResult.GetValue(pidOption), outputFormat, cancellationToken);
+        });
+
         this.AddCommands(new List<Command>
         {
-            apiShowCommand
+            apiShowCommand,
+            apiTokenCommand
         }.OrderByName());
     }
 
+    private static async Task<int> PrintTokenAsync(int? pid, OutputFormat outputFormat, CancellationToken cancellationToken)
+    {
+        try
+        {
+            ProxyInstanceState? state;
+            if (pid.HasValue)
+            {
+                state = await StateManager.LoadStateByPidAsync(pid.Value, cancellationToken);
+            }
+            else
+            {
+                var states = await StateManager.LoadAllStatesAsync(cancellationToken);
+                if (states.Count > 1)
+                {
+                    await Console.Error.WriteLineAsync("Multiple Dev Proxy instances are running. Select one with devproxy api token --pid <PID>:");
+                    foreach (var instance in states.OrderBy(instance => instance.Pid))
+                    {
+                        await Console.Error.WriteLineAsync($"  {instance.Pid}: {instance.ApiUrl}");
+                    }
+                    return 1;
+                }
+
+                state = states.SingleOrDefault();
+            }
+
+            if (state is null)
+            {
+                await Console.Error.WriteLineAsync(pid.HasValue
+                    ? $"No running Dev Proxy instance with PID {pid.Value}. Run devproxy status to find an instance."
+                    : "Dev Proxy is not running. Start it with devproxy first.");
+                return 1;
+            }
+
+            var token = await File.ReadAllTextAsync(ApiSecurity.GetTokenFilePath(state.Pid), cancellationToken);
+            if (outputFormat == OutputFormat.Json)
+            {
+                Console.WriteLine(JsonSerializer.Serialize(new { pid = state.Pid, apiUrl = state.ApiUrl, token }, ProxyUtils.JsonSerializerOptions));
+            }
+            else
+            {
+                Console.WriteLine(token);
+            }
+            return 0;
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            await Console.Error.WriteLineAsync("Unable to read the API token. Restart the selected Dev Proxy instance using the current version and the same user account.");
+            return 1;
+        }
+    }
+
     private void PrintApiInfo(OutputFormat outputFormat)
     {
-        var ipAddress = _proxyConfiguration.IPAddress;
         var apiPort = _proxyConfiguration.ApiPort;
-        var baseUrl = SystemProxyAddress.ToHttpAuthority(ipAddress, apiPort);
+        var baseUrl = ApiSecurity.GetApiUrl(new UriBuilder(Uri.UriSchemeHttp, _proxyConfiguration.ApiIpAddress, apiPort).Uri.AbsoluteUri);
+        var tokenFilePattern = Path.Combine(StateManager.GetConfigFolder(), "credentials", "api-<PID>.token");
 
         var endpoints = new[]
         {
@@ -61,7 +139,7 @@ private void PrintApiInfo(OutputFormat outputFormat)
             var json = JsonSerializer.Serialize(new
             {
                 baseUrl,
-                swaggerUrl = $"{baseUrl}/swagger/v1/swagger.json",
+                authentication = new { scheme = "Bearer", header = "Authorization", tokenFilePattern },
                 endpoints = endpoints.Select(e => new
                 {
                     method = e.Method,
@@ -74,7 +152,9 @@ private void PrintApiInfo(OutputFormat outputFormat)
         else
         {
             _logger.LogInformation("Base URL: {BaseUrl}", baseUrl);
-            _logger.LogInformation("OpenAPI spec: {SwaggerUrl}", $"{baseUrl}/swagger/v1/swagger.json");
+            _logger.LogInformation("All endpoints require Authorization: Bearer <token>.");
+            _logger.LogInformation("Get your token: devproxy api token (use --pid <PID> when multiple instances are running).");
+            _logger.LogInformation("Use devproxy status to discover running instances and their actual API ports.");
             _logger.LogInformation("");
             _logger.LogInformation("Endpoints:");
             foreach (var endpoint in endpoints)
@@ -90,4 +170,4 @@ sealed class ApiEndpointInfo
     public string Method { get; set; } = string.Empty;
     public string Path { get; set; } = string.Empty;
     public string Description { get; set; } = string.Empty;
-}
+}
\ No newline at end of file
diff --git a/DevProxy/Commands/DevProxyCommand.cs b/DevProxy/Commands/DevProxyCommand.cs
index 00b9f6ae6..493cd3c26 100644
--- a/DevProxy/Commands/DevProxyCommand.cs
+++ b/DevProxy/Commands/DevProxyCommand.cs
@@ -1,6 +1,7 @@
 using DevProxy.Abstractions.Plugins;
 using DevProxy.Abstractions.Proxy;
 using DevProxy.Abstractions.Utils;
+using DevProxy.Proxy;
 using DevProxy.State;
 using Microsoft.AspNetCore.Hosting.Server;
 using Microsoft.AspNetCore.Hosting.Server.Features;
@@ -24,6 +25,7 @@ sealed class DevProxyCommand : RootCommand
 
     internal const string PortOptionName = "--port";
     internal const string ApiPortOptionName = "--api-port";
+    internal const string ApiIpAddressOptionName = "--api-ip-address";
     internal const string IpAddressOptionName = "--ip-address";
     internal const string LogLevelOptionName = "--log-level";
     internal const string RecordOptionName = "--record";
@@ -243,7 +245,7 @@ public DevProxyCommand(
         IProxyConfiguration proxyConfiguration,
         IServiceProvider serviceProvider,
         UpdateNotification updateNotification,
-        ILogger<DevProxyCommand> logger) : base($"Start Dev Proxy\n\nAPI:\n  Dev Proxy exposes a REST API for runtime management.\n  OpenAPI spec: {SystemProxyAddress.ToHttpAuthority(proxyConfiguration.IPAddress, proxyConfiguration.ApiPort)}/swagger\n  Use --api-port to configure (default: {proxyConfiguration.ApiPort}).\n  Run 'devproxy api show' for more information.")
+        ILogger<DevProxyCommand> logger) : base($"Start Dev Proxy\n\nAPI:\n  Dev Proxy exposes an authenticated REST API for runtime management.\n  OpenAPI spec: {ApiSecurity.GetApiUrl(new UriBuilder(Uri.UriSchemeHttp, proxyConfiguration.ApiIpAddress, proxyConfiguration.ApiPort).Uri.AbsoluteUri)}/swagger\n  Use --api-port (default: {proxyConfiguration.ApiPort}) and --api-ip-address (default: 127.0.0.1).\n  The API bind address is independent of --ip-address.\n  Run 'devproxy status' for the API URL and token, or 'devproxy api show' for endpoints.")
     {
         _serviceProvider = serviceProvider;
         _plugins = plugins;
@@ -310,24 +312,30 @@ private async Task<int> InvokeAsync(ParseResult parseResult, CancellationToken c
 
         try
         {
-            _app.Lifetime.ApplicationStarted.Register(() =>
+            await ApiSecurity.SaveTokenAsync(cancellationToken);
+            await _app.StartAsync(cancellationToken);
+
+            var serverAddresses = _app.Services.GetRequiredService<IServer>().Features.Get<IServerAddressesFeature>();
+            var serverAddress = serverAddresses?.Addresses.FirstOrDefault();
+            var address = ApiSecurity.GetApiUrl(serverAddress ??
+                new UriBuilder(Uri.UriSchemeHttp, _proxyConfiguration.ApiIpAddress, _proxyConfiguration.ApiPort).Uri.AbsoluteUri);
+            _logger.LogInformation("Dev Proxy API listening on {Address}...", address);
+
+            if (_proxyConfiguration.Output != OutputFormat.Json)
             {
-                var serverAddresses = _app.Services.GetRequiredService<IServer>().Features.Get<IServerAddressesFeature>();
-                var serverAddress = serverAddresses?.Addresses.FirstOrDefault();
-                var address = Uri.TryCreate(serverAddress, UriKind.Absolute, out var serverUri) ?
-                    SystemProxyAddress.ToHttpAuthority(serverUri.DnsSafeHost, serverUri.Port) :
-                    SystemProxyAddress.ToHttpAuthority(_proxyConfiguration.IPAddress, _proxyConfiguration.ApiPort);
-                _logger.LogInformation("Dev Proxy API listening on {Address}...", address);
-
-                // Persist the daemon state so the parent process's readiness check,
-                // `devproxy stop`, and `devproxy status` can find this instance
-                // (resolves port 0 to the OS-assigned ports for both proxy and API).
-                if (IsInternalDaemon)
-                {
-                    _ = WriteDaemonStateAsync(address);
-                }
-            });
-            await _app.RunAsync(cancellationToken);
+                ApiSecurity.LogTokenOnce(_logger);
+            }
+
+            if (!System.Net.IPAddress.IsLoopback(System.Net.IPAddress.Parse(_proxyConfiguration.ApiIpAddress)))
+            {
+                _logger.LogWarning("The Dev Proxy API is bound to {ApiIpAddress} off-loopback. Bearer tokens are sent over HTTP; use only on trusted networks or through a secure tunnel.", _proxyConfiguration.ApiIpAddress);
+            }
+
+            await WriteInstanceStateAsync(address);
+            // Hotkeys write directly to the console, so release them after startup logging is complete.
+            _app.Services.GetRequiredService<InteractiveConsoleService>().CompleteStartupMessages();
+
+            await _app.WaitForShutdownAsync(cancellationToken);
 
             return 0;
         }
@@ -416,6 +424,18 @@ private void ConfigureCommand()
             Description = "The port for the Dev Proxy API to listen on",
             HelpName = "api-port"
         };
+        var apiIpAddressOption = new Option<string?>(ApiIpAddressOptionName)
+        {
+            Description = "The API bind address (default: 127.0.0.1). Use ::1 for IPv6 loopback. Non-loopback binding requires a trusted network",
+            HelpName = "api-ip-address"
+        };
+        apiIpAddressOption.Validators.Add(input =>
+        {
+            if (!System.Net.IPAddress.TryParse(input.Tokens[0].Value, out _))
+            {
+                input.AddError("The API address must be an IP address, for example 127.0.0.1 or ::1.");
+            }
+        });
 
         var recordOption = new Option<bool?>(RecordOptionName)
         {
@@ -570,6 +590,7 @@ private void ConfigureCommand()
         var options = new List<Option>
         {
             apiPortOption,
+            apiIpAddressOption,
             asSystemProxyOption,
             ConfigFileOption,
             detachedOption,
@@ -659,6 +680,11 @@ private void ConfigureFromOptions(ParseResult parseResult)
             _proxyConfiguration.ApiPort = apiPort.Value;
         }
         var ipAddress = parseResult.GetValueOrDefault<string?>(IpAddressOptionName);
+        var apiIpAddress = parseResult.GetValueOrDefault<string?>(ApiIpAddressOptionName);
+        if (apiIpAddress is not null)
+        {
+            _proxyConfiguration.ApiIpAddress = apiIpAddress;
+        }
         if (ipAddress is not null)
         {
             _proxyConfiguration.IPAddress = ipAddress;
@@ -740,12 +766,11 @@ private async Task CheckForNewVersionAsync()
         }
     }
 
-    private async Task WriteDaemonStateAsync(string apiUrl)
+    private async Task WriteInstanceStateAsync(string apiUrl)
     {
         // The proxy engine publishes its actually-bound port back to the shared
         // configuration once it binds. Wait briefly for it so the persisted state
-        // carries the real proxy port (matters for --port 0); the parent's readiness
-        // poll requires Port > 0 before it reports the daemon as started.
+        // carries the real proxy port (matters for --port 0).
         var deadline = Environment.TickCount64 + 10_000;
         while (_proxyConfiguration.Port <= 0 && Environment.TickCount64 < deadline)
         {
@@ -756,7 +781,8 @@ private async Task WriteDaemonStateAsync(string apiUrl)
         {
             Pid = Environment.ProcessId,
             ApiUrl = apiUrl,
-            LogFile = DetachedLogFilePath,
+            ProxyUrl = SystemProxyAddress.ToHttpAuthority(_proxyConfiguration.IPAddress, _proxyConfiguration.Port),
+            LogFile = IsInternalDaemon ? DetachedLogFilePath : string.Empty,
             StartedAt = DateTimeOffset.UtcNow,
             ConfigFile = _proxyConfiguration.ConfigFile,
             Port = _proxyConfiguration.Port,
diff --git a/DevProxy/Commands/DevProxyConfigOptions.cs b/DevProxy/Commands/DevProxyConfigOptions.cs
index 0abaf3ea9..111734759 100644
--- a/DevProxy/Commands/DevProxyConfigOptions.cs
+++ b/DevProxy/Commands/DevProxyConfigOptions.cs
@@ -19,6 +19,7 @@ public string? ConfigFile
     }
 
     public int? ApiPort => _parseResult?.GetValueOrDefault<int?>(DevProxyCommand.ApiPortOptionName);
+    public string? ApiIpAddress => _parseResult?.GetValueOrDefault<string?>(DevProxyCommand.ApiIpAddressOptionName);
     public bool? AsSystemProxy => _parseResult?.GetValueOrDefault<bool?>(DevProxyCommand.AsSystemProxyOptionName);
     public int? Port => _parseResult?.GetValueOrDefault<int?>(DevProxyCommand.PortOptionName);
     public bool Discover => _parseResult?.GetValueOrDefault<bool?>(DevProxyCommand.DiscoverOptionName) ?? false;
@@ -139,6 +140,7 @@ public DevProxyConfigOptions()
         };
 
         var apiPortOption = new Option<int?>(DevProxyCommand.ApiPortOptionName);
+        var apiIpAddressOption = new Option<string?>(DevProxyCommand.ApiIpAddressOptionName);
         var asSystemProxyOption = new Option<bool?>(DevProxyCommand.AsSystemProxyOptionName);
         var portOption = new Option<int?>(DevProxyCommand.PortOptionName, "-p");
 
@@ -155,6 +157,7 @@ public DevProxyConfigOptions()
         var options = new List<Option>
         {
             apiPortOption,
+            apiIpAddressOption,
             asSystemProxyOption,
             ipAddressOption,
             configFileOption,
diff --git a/DevProxy/Commands/StatusCommand.cs b/DevProxy/Commands/StatusCommand.cs
index 1d76570d5..63850da60 100644
--- a/DevProxy/Commands/StatusCommand.cs
+++ b/DevProxy/Commands/StatusCommand.cs
@@ -2,21 +2,41 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+using DevProxy.Abstractions.Proxy;
+using DevProxy.Abstractions.Utils;
 using DevProxy.State;
 using System.CommandLine;
+using System.CommandLine.Parsing;
+using System.Text.Json;
 using System.Text.Json.Serialization;
 
 namespace DevProxy.Commands;
 
 internal sealed class StatusCommand : Command
 {
+    private readonly ILogger<StatusCommand> _logger;
     private readonly Option<int?> _pidOption = new("--pid")
     {
         Description = "Show status of a specific Dev Proxy instance by PID"
     };
 
-    public StatusCommand() : base("status", "Show status of running Dev Proxy instances")
+    public StatusCommand(ILogger<StatusCommand> logger) : base("status", """
+                Show status of running Dev Proxy instances.
+
+                Examples:
+                    devproxy status
+                    devproxy status --pid 12345
+                    devproxy status --output json
+
+                Uses the current user's instance credentials. Tokens are included unless CI is set.
+                JSON output: one result event per instance, with pid, apiUrl, token, apiStatus,
+                port, recording, asSystemProxy, configFile, logFile and startedAt.
+                An empty result has running: false. Token is omitted in CI.
+                Exit codes: 0 = matching instance found; 1 = no matching instance.
+                API errors are reported in the output without changing the instance's running status.
+                """)
     {
+        _logger = logger;
         Add(_pidOption);
         SetAction(RunAsync);
     }
@@ -24,84 +44,126 @@ public StatusCommand() : base("status", "Show status of running Dev Proxy instan
     private async Task<int> RunAsync(ParseResult parseResult, CancellationToken cancellationToken)
     {
         var pid = parseResult.GetValue(_pidOption);
+        var outputFormat = parseResult.GetValueOrDefault<OutputFormat?>(DevProxyCommand.OutputOptionName) ?? OutputFormat.Text;
 
         if (pid is not null)
         {
             var state = await StateManager.LoadStateByPidAsync(pid.Value, cancellationToken);
             if (state is null)
             {
-                Console.WriteLine($"No running Dev Proxy instance with PID {pid.Value}.");
+                PrintNoInstances(outputFormat, pid);
                 return 1;
             }
 
-            await PrintInstanceStatusAsync(state, cancellationToken);
+            await PrintInstanceStatusAsync(state, outputFormat, cancellationToken);
             return 0;
         }
 
         var states = await StateManager.LoadAllStatesAsync(cancellationToken);
         if (states.Count == 0)
         {
-            Console.WriteLine("Dev Proxy is not running.");
+            PrintNoInstances(outputFormat, null);
             return 1;
         }
 
         for (var i = 0; i < states.Count; i++)
         {
-            if (i > 0)
+            if (i > 0 && outputFormat == OutputFormat.Text)
             {
                 Console.WriteLine();
             }
 
-            await PrintInstanceStatusAsync(states[i], cancellationToken);
+            await PrintInstanceStatusAsync(states[i], outputFormat, cancellationToken);
         }
 
         return 0;
     }
 
-    private static async Task PrintInstanceStatusAsync(ProxyInstanceState state, CancellationToken cancellationToken)
+    private void PrintNoInstances(OutputFormat outputFormat, int? pid)
     {
-        // Try to get live status from the API
+        if (outputFormat == OutputFormat.Json)
+        {
+            _logger.LogStructuredOutput(JsonSerializer.Serialize(new { running = false, pid }, ProxyUtils.JsonSerializerOptions));
+        }
+        else
+        {
+            Console.WriteLine(pid is null ? "Dev Proxy is not running." : $"No running Dev Proxy instance with PID {pid}.");
+        }
+    }
+
+    private async Task PrintInstanceStatusAsync(ProxyInstanceState state, OutputFormat outputFormat, CancellationToken cancellationToken)
+    {
+        ProxyStatusInfo? proxyInfo = null;
+        string? token = null;
+        var apiStatus = "unavailable";
+        var message = "Dev Proxy appears to be running (API not responding).";
         try
         {
-            using var httpClient = new HttpClient { Timeout = TimeSpan.FromSeconds(5) };
-            var response = await httpClient.GetAsync($"{state.ApiUrl}/proxy", cancellationToken);
+            using var httpClient = await ApiSecurity.CreateClientAsync(state, TimeSpan.FromSeconds(5), cancellationToken);
+            token = ApiSecurity.ShouldDisplayToken ? httpClient.DefaultRequestHeaders.Authorization!.Parameter : null;
+            using var response = await httpClient.GetAsync("/proxy", cancellationToken);
 
             if (response.IsSuccessStatusCode)
             {
-                var proxyInfo = await response.Content.ReadFromJsonAsync<ProxyStatusInfo>(cancellationToken: cancellationToken);
-
-                Console.WriteLine("Dev Proxy is running.");
-                Console.WriteLine();
-                Console.WriteLine($"  PID:              {state.Pid}");
-                Console.WriteLine($"  API URL:          {state.ApiUrl}");
-                Console.WriteLine($"  Port:             {state.Port}");
-                Console.WriteLine($"  System proxy:     {(state.AsSystemProxy ? "Yes" : "No")}");
-                Console.WriteLine($"  Recording:        {(proxyInfo?.Recording == true ? "Yes" : "No")}");
-                if (!string.IsNullOrEmpty(state.ConfigFile))
-                {
-                    Console.WriteLine($"  Config:           {state.ConfigFile}");
-                }
-                Console.WriteLine($"  Log file:         {state.LogFile}");
-                Console.WriteLine($"  Started:          {state.StartedAt.LocalDateTime:g}");
-
-                return;
+                proxyInfo = await response.Content.ReadFromJsonAsync<ProxyStatusInfo>(cancellationToken: cancellationToken);
+                apiStatus = "available";
+                message = "Dev Proxy is running.";
+            }
+            else if (response.StatusCode == System.Net.HttpStatusCode.Unauthorized)
+            {
+                apiStatus = "unauthorized";
+                message = "Dev Proxy is running, but API authentication failed. The stored token was rejected; restart this instance to regenerate its credential.";
             }
         }
-        catch (HttpRequestException)
+        catch (FormatException)
+        {
+            apiStatus = "invalidCredentials";
+            message = "The stored API token is malformed. Restart this instance to regenerate its credential.";
+        }
+        catch (Exception ex) when (ex is HttpRequestException or IOException or UnauthorizedAccessException or InvalidOperationException)
         {
-            // API not responding - instance might be starting up or crashed
         }
         catch (TaskCanceledException)
         {
-            // Timeout - instance might be busy
         }
 
-        // Fall back to state file info
-        Console.WriteLine("Dev Proxy appears to be running (API not responding).");
+        if (outputFormat == OutputFormat.Json)
+        {
+            _logger.LogStructuredOutput(JsonSerializer.Serialize(new
+            {
+                state.Pid,
+                state.ApiUrl,
+                token,
+                apiStatus,
+                message,
+                state.Port,
+                recording = proxyInfo?.Recording,
+                state.AsSystemProxy,
+                state.ConfigFile,
+                state.LogFile,
+                state.StartedAt
+            }, ProxyUtils.JsonSerializerOptions));
+            return;
+        }
+
+        Console.WriteLine(message);
         Console.WriteLine();
         Console.WriteLine($"  PID:              {state.Pid}");
         Console.WriteLine($"  API URL:          {state.ApiUrl}");
+        if (token is not null)
+        {
+            Console.WriteLine($"  API token:        {token}");
+        }
+        Console.WriteLine($"  Port:             {state.Port}");
         Console.WriteLine($"  System proxy:     {(state.AsSystemProxy ? "Yes" : "No")}");
+        if (proxyInfo is not null)
+        {
+            Console.WriteLine($"  Recording:        {(proxyInfo.Recording == true ? "Yes" : "No")}");
+        }
+        if (!string.IsNullOrEmpty(state.ConfigFile))
+        {
+            Console.WriteLine($"  Config:           {state.ConfigFile}");
+        }
         Console.WriteLine($"  Log file:         {state.LogFile}");
         Console.WriteLine($"  Started:          {state.StartedAt.LocalDateTime:g}");
     }
diff --git a/DevProxy/Commands/StopCommand.cs b/DevProxy/Commands/StopCommand.cs
index 2898f0d66..f2ae03036 100644
--- a/DevProxy/Commands/StopCommand.cs
+++ b/DevProxy/Commands/StopCommand.cs
@@ -120,8 +120,8 @@ private static async Task<int> StopInstanceAsync(ProxyInstanceState state, bool
         // Try graceful shutdown via API
         try
         {
-            using var httpClient = new HttpClient { Timeout = TimeSpan.FromSeconds(10) };
-            var response = await httpClient.PostAsync($"{state.ApiUrl}/proxy/stopProxy", null, cancellationToken);
+            using var httpClient = await ApiSecurity.CreateClientAsync(state, TimeSpan.FromSeconds(10), cancellationToken);
+            using var response = await httpClient.PostAsync("/proxy/stopProxy", null, cancellationToken);
 
             if (response.IsSuccessStatusCode || response.StatusCode == System.Net.HttpStatusCode.Accepted)
             {
@@ -176,7 +176,7 @@ private static async Task<int> StopInstanceAsync(ProxyInstanceState state, bool
             Console.WriteLine($"Use --force --pid {state.Pid} to forcefully terminate the process.");
             return 1;
         }
-        catch (HttpRequestException ex)
+        catch (Exception ex) when (ex is HttpRequestException or IOException or UnauthorizedAccessException or InvalidOperationException or FormatException)
         {
             Console.WriteLine($"Failed to connect to Dev Proxy API (PID: {state.Pid}): {ex.Message}");
             Console.WriteLine($"Use --force --pid {state.Pid} to forcefully terminate the process.");
diff --git a/DevProxy/Extensions/IServiceCollectionExtensions.cs b/DevProxy/Extensions/IServiceCollectionExtensions.cs
index cdf53e50c..105f1a897 100644
--- a/DevProxy/Extensions/IServiceCollectionExtensions.cs
+++ b/DevProxy/Extensions/IServiceCollectionExtensions.cs
@@ -22,7 +22,8 @@ static class IServiceCollectionExtensions
     public static IServiceCollection ConfigureDevProxyServices(
         this IServiceCollection services,
         ConfigurationManager configuration,
-        DevProxyConfigOptions options)
+        DevProxyConfigOptions options,
+        string[] allowedOrigins)
     {
         _ = services.AddControllers();
         _ = services.AddCors(options =>
@@ -30,9 +31,9 @@ public static IServiceCollection ConfigureDevProxyServices(
             options.AddDefaultPolicy(builder =>
             {
                 _ = builder
-                    .AllowAnyOrigin()
-                    .AllowAnyMethod()
-                    .AllowAnyHeader();
+                    .WithOrigins(allowedOrigins)
+                    .WithMethods("GET", "POST")
+                    .WithHeaders("Authorization", "Content-Type", "Accept");
             });
         });
         _ = services
@@ -76,7 +77,9 @@ static IServiceCollection AddApplicationServices(
             .AddSingleton<IProxyState, ProxyState>()
             .AddSingleton<ISystemConsole, SystemConsole>()
             .AddHostedService<ConfigFileWatcher>()
-            .AddHostedService<InteractiveConsoleService>()
+            // Share the hosted instance so the command can release its startup-output gate.
+            .AddSingleton<InteractiveConsoleService>()
+            .AddHostedService(sp => sp.GetRequiredService<InteractiveConsoleService>())
             .AddSingleton(sp => LanguageModelClientFactory.Create(sp, configuration))
             .AddSingleton<UpdateNotification>()
             .AddSingleton<DevProxyCommand>()
diff --git a/DevProxy/Program.cs b/DevProxy/Program.cs
index 2014f1f6a..9cdbcc0a0 100644
--- a/DevProxy/Program.cs
+++ b/DevProxy/Program.cs
@@ -35,9 +35,10 @@
 {
     var logFilePath = DevProxyCommand.DetachedLogFilePath;
     var logDir = Path.GetDirectoryName(logFilePath);
-    if (!string.IsNullOrEmpty(logDir) && !Directory.Exists(logDir))
+    if (!string.IsNullOrEmpty(logDir))
     {
-        _ = Directory.CreateDirectory(logDir);
+        PrivateFiles.EnsureDirectory(StateManager.GetConfigFolder());
+        PrivateFiles.EnsureDirectory(logDir);
     }
 
 #pragma warning disable CA2000 // Lifetime managed manually; disposed before Environment.Exit
@@ -185,16 +186,9 @@ await Console.Error.WriteLineAsync(
             var state = await StateManager.LoadStateByPidAsync(process.Id);
             if (state is { Port: > 0 } && !string.IsNullOrEmpty(state.ApiUrl) && !state.ApiUrl.EndsWith(":0", StringComparison.Ordinal))
             {
-                Uri? apiUri = null;
-                if (!string.IsNullOrWhiteSpace(state.ApiUrl))
-                {
-                    _ = Uri.TryCreate(state.ApiUrl, UriKind.Absolute, out apiUri);
-                }
-
-                // Build proxy URL in a way that correctly handles IPv6 hosts.
-                var hostForProxy = apiUri?.Host ?? IPAddress.Loopback.ToString();
-                var proxyUriBuilder = new UriBuilder(Uri.UriSchemeHttp, hostForProxy, state.Port);
-                var proxyUrl = proxyUriBuilder.Uri.ToString().TrimEnd('/');
+                var proxyUrl = state.ProxyUrl;
+                var token = ApiSecurity.ShouldDisplayToken ?
+                    (await File.ReadAllTextAsync(ApiSecurity.GetTokenFilePath(state.Pid))).Trim() : null;
 
                 if (isJsonOutput)
                 {
@@ -203,18 +197,28 @@ await Console.Out.WriteLineAsync(FormatJsonResultEntry(new
                         state.Pid,
                         ProxyUrl = proxyUrl,
                         state.ApiUrl,
+                        Token = token,
                         state.LogFile
                     }));
                 }
                 else
                 {
+                    var showToken = token is not null;
                     await Console.Out.WriteLineAsync("Dev Proxy started in background.");
                     await Console.Out.WriteLineAsync();
                     await Console.Out.WriteLineAsync($"  PID:       {state.Pid}");
                     await Console.Out.WriteLineAsync($"  Proxy URL: {proxyUrl}");
                     await Console.Out.WriteLineAsync($"  API URL:   {state.ApiUrl}");
+                    if (showToken)
+                    {
+                        await Console.Out.WriteLineAsync($"  API token: {token}");
+                    }
                     await Console.Out.WriteLineAsync($"  Log file:  {state.LogFile}");
                     await Console.Out.WriteLineAsync();
+                    if (!showToken)
+                    {
+                        await Console.Out.WriteLineAsync($"Use 'devproxy api token --pid {state.Pid}' to get the API token.");
+                    }
                     await Console.Out.WriteLineAsync("Use 'devproxy status' to check status.");
                     await Console.Out.WriteLineAsync("Use 'devproxy logs' to view logs.");
                     await Console.Out.WriteLineAsync("Use 'devproxy stop' to stop.");
@@ -361,23 +365,27 @@ static WebApplication BuildApplication(DevProxyConfigOptions options)
 
     _ = builder.Configuration.ConfigureDevProxyConfig(options);
     _ = builder.Logging.ConfigureDevProxyLogging(builder.Configuration, options);
-    _ = builder.Services.ConfigureDevProxyServices(builder.Configuration, options);
+    var allowedOrigins = ApiSecurity.GetAllowedOrigins(builder.Configuration);
+    _ = builder.Services.ConfigureDevProxyServices(builder.Configuration, options, allowedOrigins);
 
-    var defaultIpAddress = "127.0.0.1";
-    var ipAddress = options.IPAddress ??
-        builder.Configuration.GetValue("ipAddress", defaultIpAddress) ??
-        defaultIpAddress;
     var defaultApiPort = 8897;
     var apiPort = options.ApiPort ??
         builder.Configuration.GetValue("apiPort", defaultApiPort);
+    var apiAddressText = options.ApiIpAddress ?? builder.Configuration.GetValue("apiIpAddress", "127.0.0.1");
+    if (!IPAddress.TryParse(apiAddressText, out var apiAddress))
+    {
+        throw new InvalidOperationException("apiIpAddress must be an IP address, for example 127.0.0.1 or ::1.");
+    }
     _ = builder.WebHost.ConfigureKestrel(options =>
     {
-        options.Listen(IPAddress.Parse(ipAddress), apiPort);
+        options.Listen(apiAddress, apiPort);
     });
 
     var app = builder.Build();
 
+    _ = app.Use((context, next) => ApiSecurity.CheckOriginAsync(context, next, allowedOrigins));
     _ = app.UseCors();
+    _ = app.Use(ApiSecurity.AuthenticateAsync);
     _ = app.MapControllers();
 
     return app;
@@ -393,13 +401,6 @@ static async Task<int> RunProxyAsync(string[] args, DevProxyConfigOptions option
     }
     finally
     {
-        // Clean up state file when daemon exits
-        if (DevProxyCommand.IsInternalDaemon)
-        {
-            await StateManager.DeleteStateAsync();
-        }
-
-        // Dispose the app to clean up all services (including FileSystemWatchers in BaseLoader)
         await app.DisposeAsync();
     }
 }
@@ -442,6 +443,11 @@ static async Task<int> RunProxyAsync(string[] args, DevProxyConfigOptions option
     }
 } while (shouldRestart);
 
+if (DevProxyCommand.IsRootCommand)
+{
+    await StateManager.DeleteStateAsync();
+}
+
 if (_detachedLogWriter is not null)
 {
     await _detachedLogWriter.DisposeAsync();
diff --git a/DevProxy/Proxy/ConsoleHotkeyHandler.cs b/DevProxy/Proxy/ConsoleHotkeyHandler.cs
index 134cb787b..5554e1768 100644
--- a/DevProxy/Proxy/ConsoleHotkeyHandler.cs
+++ b/DevProxy/Proxy/ConsoleHotkeyHandler.cs
@@ -4,6 +4,8 @@
 
 using System.Globalization;
 using DevProxy.Abstractions.Proxy;
+using DevProxy.Abstractions.Utils;
+using System.Text.Json;
 
 namespace DevProxy.Proxy;
 
@@ -28,6 +30,8 @@ internal sealed class ConsoleHotkeyHandler(
     IProxyConfiguration configuration,
     ISystemConsole console)
 {
+    private static readonly JsonSerializerOptions _jsonOptions = new(ProxyUtils.JsonSerializerOptions) { WriteIndented = false };
+
     /// <summary>
     /// Prints the banner appropriate for the current output mode: machine-readable
     /// API instructions in JSON mode, human hotkey hints otherwise.
@@ -54,13 +58,27 @@ public void PrintHotkeys()
 
     public void PrintApiInstructions()
     {
-        var baseUrl = SystemProxyAddress.ToHttpAuthority(configuration.IPAddress, configuration.ApiPort) + "/proxy";
+        var apiUrl = ApiSecurity.GetApiUrl(new UriBuilder(Uri.UriSchemeHttp, configuration.ApiIpAddress, configuration.ApiPort).Uri.AbsoluteUri);
+        var baseUrl = $"{apiUrl}/proxy";
         var timestamp = DateTime.UtcNow.ToString("O", CultureInfo.InvariantCulture);
+        console.WriteLine(JsonSerializer.Serialize(new
+        {
+            type = "result",
+            data = new
+            {
+                pid = Environment.ProcessId,
+                apiUrl,
+                token = ApiSecurity.DisplayToken
+            },
+            category = "ProxyEngine",
+            timestamp
+        }, _jsonOptions));
         console.WriteLine("");
-        console.WriteLine($"{{\"type\":\"log\",\"level\":\"info\",\"message\":\"Issue web request: curl -X POST {baseUrl}/mockRequest\",\"category\":\"ProxyEngine\",\"timestamp\":\"{timestamp}\"}}");
-        console.WriteLine($"{{\"type\":\"log\",\"level\":\"info\",\"message\":\"Start recording: curl -X POST {baseUrl} -H \\\"Content-Type: application/json\\\" -d '{{\\\"recording\\\": true}}'\",\"category\":\"ProxyEngine\",\"timestamp\":\"{timestamp}\"}}");
-        console.WriteLine($"{{\"type\":\"log\",\"level\":\"info\",\"message\":\"Stop recording: curl -X POST {baseUrl} -H \\\"Content-Type: application/json\\\" -d '{{\\\"recording\\\": false}}'\",\"category\":\"ProxyEngine\",\"timestamp\":\"{timestamp}\"}}");
-        console.WriteLine($"{{\"type\":\"log\",\"level\":\"info\",\"message\":\"Stop Dev Proxy: curl -X POST {baseUrl}/stopProxy\",\"category\":\"ProxyEngine\",\"timestamp\":\"{timestamp}\"}}");
+        console.WriteLine($"{{\"type\":\"log\",\"level\":\"info\",\"message\":\"All API requests require Authorization: Bearer <token>. In CI, retrieve it explicitly with devproxy api token --pid {Environment.ProcessId}.\",\"category\":\"ProxyEngine\",\"timestamp\":\"{timestamp}\"}}");
+        console.WriteLine($"{{\"type\":\"log\",\"level\":\"info\",\"message\":\"Issue web request: POST {baseUrl}/mockRequest\",\"category\":\"ProxyEngine\",\"timestamp\":\"{timestamp}\"}}");
+        console.WriteLine($"{{\"type\":\"log\",\"level\":\"info\",\"message\":\"Start recording: POST {baseUrl} with JSON {{\\\"recording\\\":true}}\",\"category\":\"ProxyEngine\",\"timestamp\":\"{timestamp}\"}}");
+        console.WriteLine($"{{\"type\":\"log\",\"level\":\"info\",\"message\":\"Stop recording: POST {baseUrl} with JSON {{\\\"recording\\\":false}}\",\"category\":\"ProxyEngine\",\"timestamp\":\"{timestamp}\"}}");
+        console.WriteLine($"{{\"type\":\"log\",\"level\":\"info\",\"message\":\"Stop Dev Proxy: POST {baseUrl}/stopProxy\",\"category\":\"ProxyEngine\",\"timestamp\":\"{timestamp}\"}}");
         console.WriteLine("");
     }
 
diff --git a/DevProxy/Proxy/InteractiveConsoleService.cs b/DevProxy/Proxy/InteractiveConsoleService.cs
index a371f50a5..9e4f7fb12 100644
--- a/DevProxy/Proxy/InteractiveConsoleService.cs
+++ b/DevProxy/Proxy/InteractiveConsoleService.cs
@@ -48,6 +48,10 @@ internal sealed class InteractiveConsoleService(
     private static readonly TimeSpan _keyPollInterval = TimeSpan.FromMilliseconds(10);
 
     private readonly ConsoleHotkeyHandler _handler = new(controller, configuration, console);
+    // Direct console output must wait until queued startup logs have been submitted.
+    private readonly TaskCompletionSource _startupMessagesCompleted = new(TaskCreationOptions.RunContinuationsAsynchronously);
+
+    internal void CompleteStartupMessages() => _startupMessagesCompleted.TrySetResult();
 
     /// <summary>
     /// Hotkeys are only usable from a real terminal driven by a human. Skip the
@@ -81,6 +85,15 @@ protected override async Task ExecuteAsync(CancellationToken stoppingToken)
             controller.StartRecording();
         }
 
+        try
+        {
+            await _startupMessagesCompleted.Task.WaitAsync(stoppingToken);
+        }
+        catch (OperationCanceledException)
+        {
+            return;
+        }
+
         if (configuration.Output == OutputFormat.Json)
         {
             // Always print API instructions in machine mode so LLMs/agents can use
diff --git a/DevProxy/Proxy/ProxyConfiguration.cs b/DevProxy/Proxy/ProxyConfiguration.cs
index a4c5d5fd1..021963578 100755
--- a/DevProxy/Proxy/ProxyConfiguration.cs
+++ b/DevProxy/Proxy/ProxyConfiguration.cs
@@ -13,6 +13,7 @@ sealed class ProxyConfiguration : IProxyConfiguration
     private readonly IConfigurationRoot _configurationRoot;
 
     public int ApiPort { get; set; } = 8897;
+    public string ApiIpAddress { get; set; } = "127.0.0.1";
     public bool AsSystemProxy { get; set; } = true;
     private bool configFileResolved;
     private string configFile = string.Empty;
@@ -67,4 +68,4 @@ internal static string GetConfigFilePath(IConfigurationRoot configurationRoot)
         var fileInfo = provider.Source.FileProvider!.GetFileInfo(provider.Source.Path!);
         return fileInfo.PhysicalPath!;
     }
-}
+}
\ No newline at end of file
diff --git a/DevProxy/State/PrivateFiles.cs b/DevProxy/State/PrivateFiles.cs
new file mode 100644
index 000000000..cd7e416d5
--- /dev/null
+++ b/DevProxy/State/PrivateFiles.cs
@@ -0,0 +1,113 @@
+using System.Runtime.Versioning;
+using System.Security.AccessControl;
+using System.Security.Principal;
+
+namespace DevProxy.State;
+
+internal static class PrivateFiles
+{
+    public static void EnsureDirectory(string directory, bool secureExisting = false)
+    {
+        if (Path.Exists(directory) && (File.GetAttributes(directory) & FileAttributes.ReparsePoint) != 0)
+        {
+            throw new IOException("Private Dev Proxy directories must not be symbolic links.");
+        }
+
+        if (OperatingSystem.IsWindows())
+        {
+            EnsureWindowsDirectory(directory, secureExisting);
+        }
+        else
+        {
+            const UnixFileMode mode = UnixFileMode.UserRead | UnixFileMode.UserWrite | UnixFileMode.UserExecute;
+            _ = Directory.CreateDirectory(directory, mode);
+            if (secureExisting)
+            {
+                File.SetUnixFileMode(directory, mode);
+            }
+        }
+    }
+
+    [SupportedOSPlatform("windows")]
+    private static void EnsureWindowsDirectory(string directory, bool secureExisting)
+    {
+        var exists = Directory.Exists(directory);
+        if (exists && !secureExisting)
+        {
+            return;
+        }
+        using var identity = WindowsIdentity.GetCurrent();
+        var owner = identity.User ?? throw new InvalidOperationException("Unable to identify the current user.");
+        var security = new DirectorySecurity();
+        security.SetOwner(owner);
+        security.SetAccessRuleProtection(isProtected: true, preserveInheritance: false);
+        security.AddAccessRule(new FileSystemAccessRule(owner, FileSystemRights.FullControl,
+            InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit,
+            PropagationFlags.None, AccessControlType.Allow));
+        var info = new DirectoryInfo(directory);
+        if (!exists)
+        {
+            info.Create(security);
+        }
+        else
+        {
+            const AccessControlSections sections = AccessControlSections.Access | AccessControlSections.Owner;
+            if (info.GetAccessControl(sections).GetSecurityDescriptorSddlForm(sections) != security.GetSecurityDescriptorSddlForm(sections))
+            {
+                info.SetAccessControl(security);
+            }
+        }
+    }
+
+    [SupportedOSPlatform("windows")]
+    private static FileStream CreateWindowsFile(string path)
+    {
+        using var identity = WindowsIdentity.GetCurrent();
+        var owner = identity.User ?? throw new InvalidOperationException("Unable to identify the current user.");
+        var security = new FileSecurity();
+        security.SetOwner(owner);
+        security.SetAccessRuleProtection(isProtected: true, preserveInheritance: false);
+        security.AddAccessRule(new FileSystemAccessRule(owner, FileSystemRights.FullControl, AccessControlType.Allow));
+        return new FileInfo(path).Create(FileMode.CreateNew, FileSystemRights.FullControl,
+            FileShare.None, 4096, FileOptions.Asynchronous, security);
+    }
+
+    public static async Task WriteAllTextAsync(string path, string contents, CancellationToken cancellationToken = default)
+    {
+        EnsureDirectory(Path.GetDirectoryName(path)!);
+        var stagingPath = $"{path}.{Guid.NewGuid():N}";
+        try
+        {
+            var options = new FileStreamOptions
+            {
+                Mode = FileMode.CreateNew,
+                Access = FileAccess.Write,
+                Share = FileShare.None,
+                Options = FileOptions.Asynchronous
+            };
+            if (!OperatingSystem.IsWindows())
+            {
+                options.UnixCreateMode = UnixFileMode.UserRead | UnixFileMode.UserWrite;
+            }
+
+            await using (var stream = OperatingSystem.IsWindows() ? CreateWindowsFile(stagingPath) : new FileStream(stagingPath, options))
+            await using (var writer = new StreamWriter(stream))
+            {
+                await writer.WriteAsync(contents.AsMemory(), cancellationToken);
+            }
+
+            File.Move(stagingPath, path, overwrite: true);
+        }
+        catch
+        {
+            try
+            {
+                File.Delete(stagingPath);
+            }
+            catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+            {
+            }
+            throw;
+        }
+    }
+}
\ No newline at end of file
diff --git a/DevProxy/State/ProxyInstanceState.cs b/DevProxy/State/ProxyInstanceState.cs
index be1f80dfa..ad951253d 100644
--- a/DevProxy/State/ProxyInstanceState.cs
+++ b/DevProxy/State/ProxyInstanceState.cs
@@ -18,6 +18,9 @@ internal sealed class ProxyInstanceState
     [JsonPropertyName("apiUrl")]
     public string ApiUrl { get; set; } = string.Empty;
 
+    [JsonPropertyName("proxyUrl")]
+    public string ProxyUrl { get; set; } = string.Empty;
+
     [JsonPropertyName("logFile")]
     public string LogFile { get; set; } = string.Empty;
 
diff --git a/DevProxy/State/StateManager.cs b/DevProxy/State/StateManager.cs
index 39607d9d7..4457a5fbc 100644
--- a/DevProxy/State/StateManager.cs
+++ b/DevProxy/State/StateManager.cs
@@ -91,15 +91,9 @@ public static string GenerateLogFilePath()
     public static async Task SaveStateAsync(ProxyInstanceState state, CancellationToken cancellationToken = default)
     {
         var stateFilePath = GetInstanceStateFilePath(state.Pid);
-        var directory = Path.GetDirectoryName(stateFilePath);
-
-        if (!string.IsNullOrEmpty(directory) && !Directory.Exists(directory))
-        {
-            _ = Directory.CreateDirectory(directory);
-        }
 
         var json = JsonSerializer.Serialize(state, _jsonOptions);
-        await File.WriteAllTextAsync(stateFilePath, json, cancellationToken);
+        await PrivateFiles.WriteAllTextAsync(stateFilePath, json, cancellationToken);
     }
 
     /// <summary>
@@ -140,6 +134,19 @@ public static async Task<List<ProxyInstanceState>> LoadAllStatesAsync(Cancellati
         var states = new List<ProxyInstanceState>();
         var seenPids = new HashSet<int>();
 
+        var credentialsFolder = Path.Combine(configFolder, "credentials");
+        if (Directory.Exists(credentialsFolder))
+        {
+            foreach (var credentialFile in Directory.GetFiles(credentialsFolder, "api-*.token"))
+            {
+                if (int.TryParse(Path.GetFileNameWithoutExtension(credentialFile).AsSpan(4), out var pid) &&
+                    !IsProcessRunning(pid))
+                {
+                    DeleteFile(credentialFile);
+                }
+            }
+        }
+
         // Check per-instance state files
         var stateFiles = Directory.GetFiles(configFolder, $"{StateFilePrefix}*{StateFileExtension}");
         foreach (var filePath in stateFiles)
@@ -222,6 +229,7 @@ public static async Task<List<ProxyInstanceState>> GetOrphanedSystemProxyStatesA
     public static async Task DeleteStateAsync(int pid, CancellationToken cancellationToken = default)
     {
         DeleteFile(GetInstanceStateFilePath(pid));
+        DeleteFile(ApiSecurity.GetTokenFilePath(pid));
 
         // Also clean up legacy state file if it belongs to this PID
         var legacyPath = GetStateFilePath();
@@ -307,6 +315,7 @@ private static bool IsProcessRunning(int pid)
         {
             // Clean up stale state file
             DeleteFile(filePath);
+            DeleteFile(ApiSecurity.GetTokenFilePath(state.Pid));
             return null;
         }
 
diff --git a/Dockerfile b/Dockerfile
index 551f1a425..1aeaa6acc 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -44,4 +44,5 @@ WORKDIR /config
 
 USER ${USERNAME}
 
-ENTRYPOINT ["/app/devproxy/devproxy", "--ip-address", "0.0.0.0"]
+ENV PATH="/app/devproxy:${PATH}"
+ENTRYPOINT ["/app/devproxy/devproxy", "--ip-address", "0.0.0.0", "--api-ip-address", "0.0.0.0"]
diff --git a/Dockerfile_beta b/Dockerfile_beta
index 20429de73..ba16404ce 100644
--- a/Dockerfile_beta
+++ b/Dockerfile_beta
@@ -44,4 +44,5 @@ WORKDIR /config
 
 USER ${USERNAME}
 
-ENTRYPOINT ["/app/devproxy-beta/devproxy-beta", "--ip-address", "0.0.0.0"]
+ENV PATH="/app/devproxy-beta:${PATH}"
+ENTRYPOINT ["/app/devproxy-beta/devproxy-beta", "--ip-address", "0.0.0.0", "--api-ip-address", "0.0.0.0"]
diff --git a/schemas/v3.3.1/apicenterminimalpermissionsplugin.schema.json b/schemas/v3.3.1/apicenterminimalpermissionsplugin.schema.json
new file mode 100644
index 000000000..582fe633a
--- /dev/null
+++ b/schemas/v3.3.1/apicenterminimalpermissionsplugin.schema.json
@@ -0,0 +1,38 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy ApiCenterMinimalPermissionsPlugin config schema",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "The JSON schema reference for validation."
+    },
+    "resourceGroupName": {
+      "type": "string",
+      "description": "Name of the resource group where the Azure API Center is located."
+    },
+    "serviceName": {
+      "type": "string",
+      "description": "Name of the Azure API Center instance that Dev Proxy should use to check if the APIs used in the app are registered."
+    },
+    "subscriptionId": {
+      "type": "string",
+      "description": "ID of the Azure subscription where the Azure API Center instance is located."
+    },
+    "workspaceName": {
+      "type": "string",
+      "description": "Name of the Azure API Center workspace to use. Default is 'default'.",
+      "default": "default"
+    },
+    "schemeName": {
+      "type": "string",
+      "description": "The name of the security scheme definition. Used to determine minimal permissions required for API calls."
+    }
+  },
+  "required": [
+    "resourceGroupName",
+    "serviceName",
+    "subscriptionId"
+  ],
+  "additionalProperties": false
+}
\ No newline at end of file
diff --git a/schemas/v3.3.1/apicenteronboardingplugin.schema.json b/schemas/v3.3.1/apicenteronboardingplugin.schema.json
new file mode 100644
index 000000000..35ce03d26
--- /dev/null
+++ b/schemas/v3.3.1/apicenteronboardingplugin.schema.json
@@ -0,0 +1,37 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy ApiCenterOnboardingPlugin config schema",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "The JSON schema reference for validation."
+    },
+    "createApicEntryForNewApis": {
+      "type": "boolean",
+      "description": "Set to true to have Dev Proxy create new API entries for APIs detected but not yet registered in API Center. When false, Dev Proxy only lists unregistered APIs. Default is true."
+    },
+    "resourceGroupName": {
+      "type": "string",
+      "description": "Name of the resource group where the Azure API Center is located."
+    },
+    "serviceName": {
+      "type": "string",
+      "description": "Name of the Azure API Center instance that Dev Proxy should use to check if the APIs used in the app are registered."
+    },
+    "subscriptionId": {
+      "type": "string",
+      "description": "ID of the Azure subscription where the Azure API Center instance is located."
+    },
+    "workspaceName": {
+      "type": "string",
+      "description": "Name of the Azure API Center workspace to use. Default is 'default'."
+    }
+  },
+  "required": [
+    "resourceGroupName",
+    "serviceName",
+    "subscriptionId"
+  ],
+  "additionalProperties": false
+}
\ No newline at end of file
diff --git a/schemas/v3.3.1/apicenterproductionversionplugin.schema.json b/schemas/v3.3.1/apicenterproductionversionplugin.schema.json
new file mode 100644
index 000000000..5caacc503
--- /dev/null
+++ b/schemas/v3.3.1/apicenterproductionversionplugin.schema.json
@@ -0,0 +1,33 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy ApiCenterProductionVersionPlugin config schema",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "The JSON schema reference for validation."
+    },
+    "resourceGroupName": {
+      "type": "string",
+      "description": "Name of the resource group where the Azure API Center is located."
+    },
+    "serviceName": {
+      "type": "string",
+      "description": "Name of the Azure API Center instance that Dev Proxy should use to check if the APIs used in the app are registered."
+    },
+    "subscriptionId": {
+      "type": "string",
+      "description": "ID of the Azure subscription where the Azure API Center instance is located."
+    },
+    "workspaceName": {
+      "type": "string",
+      "description": "Name of the Azure API Center workspace to use. Default is 'default'."
+    }
+  },
+  "required": [
+    "resourceGroupName",
+    "serviceName",
+    "subscriptionId"
+  ],
+  "additionalProperties": false
+}
\ No newline at end of file
diff --git a/schemas/v3.3.1/authplugin.schema.json b/schemas/v3.3.1/authplugin.schema.json
new file mode 100644
index 000000000..900d07aeb
--- /dev/null
+++ b/schemas/v3.3.1/authplugin.schema.json
@@ -0,0 +1,133 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy AuthPlugin config schema",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "The JSON schema reference for validation."
+    },
+    "apiKey": {
+      "type": "object",
+      "description": "Configuration for API key authentication and authorization.",
+      "properties": {
+        "allowedKeys": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "List of allowed API keys."
+        },
+        "parameters": {
+          "type": "array",
+          "description": "List of parameters that contain the API key.",
+          "items": {
+            "type": "object",
+            "properties": {
+              "in": {
+                "type": "string",
+                "enum": [
+                  "header",
+                  "query",
+                  "cookie"
+                ],
+                "description": "Where the parameter is expected to be found. Allowed values: header, query, cookie."
+              },
+              "name": {
+                "type": "string",
+                "description": "Name of the parameter."
+              }
+            },
+            "required": [
+              "in",
+              "name"
+            ]
+          }
+        }
+      },
+      "required": [
+        "allowedKeys",
+        "parameters"
+      ]
+    },
+    "oauth2": {
+      "type": "object",
+      "description": "Configuration for OAuth2 authentication and authorization.",
+      "properties": {
+        "metadataUrl": {
+          "type": "string",
+          "description": "URL to the OpenID Connect metadata document."
+        },
+        "allowedApplications": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "List of allowed application IDs. Leave empty to not validate the application (appid or azp claim) for which the token is issued."
+        },
+        "allowedAudiences": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "List of allowed audiences. Leave empty to not validate the audience (aud claim) for which the token is issued."
+        },
+        "allowedPrincipals": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "List of allowed principals. Leave empty to not validate the principal (oid claim) for which the token is issued."
+        },
+        "allowedTenants": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "List of allowed tenants. Leave empty to not validate the tenant (tid claim) for which the token is issued."
+        },
+        "issuer": {
+          "type": "string",
+          "description": "Allowed token issuer. Leave empty to not validate the token issuer."
+        },
+        "roles": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "List of allowed roles. Leave empty to not validate the roles (roles claim) on the token."
+        },
+        "scopes": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "List of allowed scopes. Leave empty to not validate the scopes (scp claim) on the token."
+        },
+        "validateLifetime": {
+          "type": "boolean",
+          "description": "Set to false to disable validating the token lifetime. Default is true."
+        },
+        "validateSigningKey": {
+          "type": "boolean",
+          "description": "Set to false to disable validating the token signature. Default is true."
+        }
+      },
+      "required": [
+        "metadataUrl"
+      ]
+    },
+    "type": {
+      "type": "string",
+      "enum": [
+        "apiKey",
+        "oauth2"
+      ],
+      "description": "Type of authentication and authorization that Dev Proxy should use. Allowed values: apiKey, oauth2."
+    }
+  },
+  "required": [
+    "type"
+  ],
+  "additionalProperties": false
+}
\ No newline at end of file
diff --git a/schemas/v3.3.1/cachingguidanceplugin.schema.json b/schemas/v3.3.1/cachingguidanceplugin.schema.json
new file mode 100644
index 000000000..18116180a
--- /dev/null
+++ b/schemas/v3.3.1/cachingguidanceplugin.schema.json
@@ -0,0 +1,16 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy CachingGuidancePlugin config schema",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "The JSON schema reference for validation."
+    },
+    "cacheThresholdSeconds": {
+      "type": "integer",
+      "description": "The number of seconds between the same request that triggers the guidance warning. Default is 5."
+    }
+  },
+  "additionalProperties": false
+}
\ No newline at end of file
diff --git a/schemas/v3.3.1/crudapiplugin.apifile.schema.json b/schemas/v3.3.1/crudapiplugin.apifile.schema.json
new file mode 100644
index 000000000..35f6fc7a9
--- /dev/null
+++ b/schemas/v3.3.1/crudapiplugin.apifile.schema.json
@@ -0,0 +1,178 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "CRUD API plugin API definition",
+  "description": "API definition for use with the CRUD API Dev Proxy plugin",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "The JSON schema reference for validation."
+    },
+    "baseUrl": {
+      "type": "string",
+      "description": "Base URL where Dev Proxy exposes the API. Dev Proxy prepends this base URL to the URLs defined in actions."
+    },
+    "enableCors": {
+      "type": "boolean",
+      "description": "Set to true to enable CORS for the API. Default is true."
+    },
+    "dataFile": {
+      "type": "string",
+      "description": "Path to the file that contains the data for the API. The file must define a JSON array."
+    },
+    "actions": {
+      "type": "array",
+      "description": "List of actions that the API supports. Each action defines how Dev Proxy interacts with the data.",
+      "items": {
+        "type": "object",
+        "properties": {
+          "action": {
+            "type": "string",
+            "enum": [
+              "create",
+              "getAll",
+              "getOne",
+              "getMany",
+              "merge",
+              "update",
+              "delete"
+            ],
+            "description": "Defines the type of action. Possible values: getAll, getOne, getMany, create, merge, update, delete."
+          },
+          "url": {
+            "type": "string",
+            "description": "URL where Dev Proxy exposes the action. Appended to the baseUrl. Can contain parameters in curly braces."
+          },
+          "query": {
+            "type": "string",
+            "description": "JSONPath query (using Newtonsoft.Json) that Dev Proxy uses to find the data in the data file. Parameters can be referenced using curly braces."
+          },
+          "method": {
+            "type": "string",
+            "enum": [
+              "GET",
+              "POST",
+              "PUT",
+              "PATCH",
+              "DELETE",
+              "QUERY"
+            ],
+            "description": "HTTP method that Dev Proxy uses to expose the action. Defaults depend on the action type."
+          },
+          "auth": {
+            "type": "string",
+            "enum": [
+              "none",
+              "entra"
+            ],
+            "description": "Determines if the action is secured. Allowed values: none, entra. Default is none."
+          },
+          "entraAuthConfig": {
+            "type": "object",
+            "description": "Configuration for Microsoft Entra authentication for this action. Overrides the root entraAuthConfig if specified.",
+            "properties": {
+              "audience": {
+                "type": "string",
+                "description": "Valid audience for the token. If specified, the token's audience must match."
+              },
+              "issuer": {
+                "type": "string",
+                "description": "Valid token issuer. If specified, the token's issuer must match."
+              },
+              "scopes": {
+                "type": "array",
+                "items": { "type": "string" },
+                "description": "Array of valid scopes. At least one must be present in the token."
+              },
+              "roles": {
+                "type": "array",
+                "items": { "type": "string" },
+                "description": "Array of valid roles. At least one must be present in the token."
+              },
+              "validateLifetime": {
+                "type": "boolean",
+                "description": "Set to true to validate that the token hasn't expired."
+              },
+              "validateSigningKey": {
+                "type": "boolean",
+                "description": "Set to true to validate the token's signature."
+              }
+            }
+          }
+        },
+        "required": [
+          "action"
+        ],
+        "additionalProperties": false
+      }
+    },
+    "auth": {
+      "type": "string",
+      "enum": [
+        "none",
+        "entra",
+        "apiKey"
+      ],
+      "description": "Determines if the API is secured. Allowed values: none, entra, apiKey. Default is none."
+    },
+    "apiKeyAuthConfig": {
+      "type": "object",
+      "description": "Configuration for API Key authentication. Applies to all actions unless overridden at the action level.",
+      "properties": {
+        "apiKey": {
+          "type": "string",
+          "description": "The valid API key that must be present in the request."
+        },
+        "headerName": {
+          "type": "string",
+          "description": "The HTTP header name to read the API key from."
+        },
+        "queryParameterName": {
+          "type": "string",
+          "description": "The name of the query-string parameter to read the API key from."
+        }
+      },
+      "required": [
+        "apiKey"
+      ]
+    },
+    "entraAuthConfig": {
+      "type": "object",
+      "description": "Configuration for Microsoft Entra authentication. Applies to all actions unless overridden at the action level.",
+      "properties": {
+        "audience": {
+          "type": "string",
+          "description": "Valid audience for the token. If specified, the token's audience must match."
+        },
+        "issuer": {
+          "type": "string",
+          "description": "Valid token issuer. If specified, the token's issuer must match."
+        },
+        "scopes": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Array of valid scopes. At least one must be present in the token."
+        },
+        "roles": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Array of valid roles. At least one must be present in the token."
+        },
+        "validateLifetime": {
+          "type": "boolean",
+          "description": "Set to true to validate that the token hasn't expired. Default is false."
+        },
+        "validateSigningKey": {
+          "type": "boolean",
+          "description": "Set to true to validate the token's signature. Default is false."
+        }
+      }
+    }
+  },
+  "required": [
+    "baseUrl",
+    "dataFile",
+    "actions"
+  ],
+  "additionalProperties": true
+}
\ No newline at end of file
diff --git a/schemas/v3.3.1/crudapiplugin.schema.json b/schemas/v3.3.1/crudapiplugin.schema.json
new file mode 100644
index 000000000..8c6d499ca
--- /dev/null
+++ b/schemas/v3.3.1/crudapiplugin.schema.json
@@ -0,0 +1,19 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy CrudApiPlugin config schema",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "The JSON schema reference for validation."
+    },
+    "apiFile": {
+      "type": "string",
+      "description": "Path to the file that contains the definition of the CRUD API."
+    }
+  },
+  "required": [
+    "apiFile"
+  ],
+  "additionalProperties": false
+}
\ No newline at end of file
diff --git a/schemas/v3.3.1/devtoolsplugin.schema.json b/schemas/v3.3.1/devtoolsplugin.schema.json
new file mode 100644
index 000000000..ceb730308
--- /dev/null
+++ b/schemas/v3.3.1/devtoolsplugin.schema.json
@@ -0,0 +1,22 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy DevToolsPlugin config schema",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "The JSON schema reference for validation."
+    },
+    "preferredBrowser": {
+      "type": "string",
+      "enum": [
+        "Edge",
+        "EdgeDev",
+        "Chrome",
+        "EdgeBeta"
+      ]
+      "description": "Which browser to use to launch Dev Tools. Supported values: Edge, EdgeDev, Chrome. Default: Edge."
+    }
+  },
+  "additionalProperties": false
+}
\ No newline at end of file
diff --git a/schemas/v3.3.1/executionsummaryplugin.schema.json b/schemas/v3.3.1/executionsummaryplugin.schema.json
new file mode 100644
index 000000000..e370b0523
--- /dev/null
+++ b/schemas/v3.3.1/executionsummaryplugin.schema.json
@@ -0,0 +1,20 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy ExecutionSummaryPlugin config schema",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "The JSON schema reference for validation."
+    },
+    "groupBy": {
+      "type": "string",
+      "enum": [
+        "url",
+        "messageType"
+      ],
+      "description": "How proxy should group the information in the summary. Available options: url, messageType. Default: url."
+    }
+  },
+  "additionalProperties": false
+}
\ No newline at end of file
diff --git a/schemas/v3.3.1/genericrandomerrorplugin.errorsfile.schema.json b/schemas/v3.3.1/genericrandomerrorplugin.errorsfile.schema.json
new file mode 100644
index 000000000..f3c4491cf
--- /dev/null
+++ b/schemas/v3.3.1/genericrandomerrorplugin.errorsfile.schema.json
@@ -0,0 +1,106 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy GenericRandomErrorPlugin responses",
+  "description": "Error responses for the Dev Proxy GenericRandomErrorPlugin",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "The JSON schema reference for validation."
+    },
+    "errors": {
+      "type": "array",
+      "description": "List of error response definitions to simulate. Each entry defines a request pattern and possible error responses.",
+      "items": {
+        "type": "object",
+        "properties": {
+          "request": {
+            "type": "object",
+            "description": "Request pattern to match for simulating an error.",
+            "properties": {
+              "url": {
+                "type": "string",
+                "description": "URL pattern to match for the request. Supports wildcards."
+              },
+              "method": {
+                "type": "string",
+                "enum": [
+                  "GET",
+                  "POST",
+                  "PUT",
+                  "PATCH",
+                  "DELETE",
+                  "HEAD",
+                  "OPTIONS",
+                  "CONNECT",
+                  "TRACE",
+                  "QUERY"
+                ],
+                "description": "HTTP method to match for the request. Optional."
+              },
+              "bodyFragment": {
+                "type": "string",
+                "description": "Fragment of the request body to match. Optional."
+              }
+            },
+            "required": [
+              "url"
+            ]
+          },
+          "responses": {
+            "type": "array",
+            "description": "Possible error responses to return for the matched request.",
+            "items": {
+              "type": "object",
+              "properties": {
+                "body": {
+                  "type": [
+                    "object",
+                    "array",
+                    "string",
+                    "number",
+                    "boolean"
+                  ],
+                  "description": "Response body to return. Can be an object, array, string, number, or boolean."
+                },
+                "statusCode": {
+                  "type": "integer",
+                  "description": "HTTP status code to return."
+                },
+                "headers": {
+                  "type": "array",
+                  "description": "List of headers to include in the response.",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "name": {
+                        "type": "string",
+                        "description": "Header name."
+                      },
+                      "value": {
+                        "type": "string",
+                        "description": "Header value."
+                      }
+                    },
+                    "required": [
+                      "name",
+                      "value"
+                    ]
+                  }
+                }
+              }
+            }
+          }
+        },
+        "required": [
+          "request",
+          "responses"
+        ]
+      }
+    }
+  },
+  "required": [
+    "errors"
+  ],
+  "additionalProperties": true
+}
\ No newline at end of file
diff --git a/schemas/v3.3.1/genericrandomerrorplugin.schema.json b/schemas/v3.3.1/genericrandomerrorplugin.schema.json
new file mode 100644
index 000000000..fde0213e5
--- /dev/null
+++ b/schemas/v3.3.1/genericrandomerrorplugin.schema.json
@@ -0,0 +1,30 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy GenericRandomErrorPlugin config schema",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "The JSON schema reference for validation."
+    },
+    "errorsFile": {
+      "type": "string",
+      "description": "Path to the file that contains error responses."
+    },
+    "rate": {
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 100,
+      "description": "The percentage of requests to fail with a random error. Value between 0 and 100."
+    },
+    "retryAfterInSeconds": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "The number of seconds to wait before retrying the request. Included on the Retry-After response header for dynamic throttling. Default: 5."
+    }
+  },
+  "required": [
+    "errorsFile"
+  ],
+  "additionalProperties": false
+}
\ No newline at end of file
diff --git a/schemas/v3.3.1/graphminimalpermissionsguidanceplugin.schema.json b/schemas/v3.3.1/graphminimalpermissionsguidanceplugin.schema.json
new file mode 100644
index 000000000..721994513
--- /dev/null
+++ b/schemas/v3.3.1/graphminimalpermissionsguidanceplugin.schema.json
@@ -0,0 +1,20 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy GraphMinimalPermissionsGuidancePlugin config schema",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "Reference to the JSON schema definition."
+    },
+    "permissionsToExclude": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "description": "The scopes to ignore and not include in the report. Default: ['profile', 'openid', 'offline_access', 'email'].",
+      "default": ["profile", "openid", "offline_access", "email"]
+    }
+  },
+  "additionalProperties": false
+}
\ No newline at end of file
diff --git a/schemas/v3.3.1/graphminimalpermissionsplugin.schema.json b/schemas/v3.3.1/graphminimalpermissionsplugin.schema.json
new file mode 100644
index 000000000..d72dd68fa
--- /dev/null
+++ b/schemas/v3.3.1/graphminimalpermissionsplugin.schema.json
@@ -0,0 +1,20 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy GraphMinimalPermissionsPlugin config schema",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "Reference to the JSON schema definition."
+    },
+    "type": {
+      "type": "string",
+      "enum": [
+        "delegated",
+        "application"
+      ],
+      "description": "Determines which type of permission scopes to return. Can be 'delegated' or 'application'. Default: 'delegated'."
+    }
+  },
+  "additionalProperties": false
+}
\ No newline at end of file
diff --git a/schemas/v3.3.1/graphrandomerrorplugin.schema.json b/schemas/v3.3.1/graphrandomerrorplugin.schema.json
new file mode 100644
index 000000000..79db8a233
--- /dev/null
+++ b/schemas/v3.3.1/graphrandomerrorplugin.schema.json
@@ -0,0 +1,32 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy GraphRandomErrorPlugin config schema",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "Reference to the JSON schema definition."
+    },
+    "allowedErrors": {
+      "type": "array",
+      "description": "Array of HTTP status codes (integers between 400 and 599) that the plugin can use to simulate errors. For example, [429] to simulate throttling.",
+      "items": {
+        "type": "integer",
+        "minimum": 400,
+        "maximum": 599
+      }
+    },
+    "rate": {
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 100,
+      "description": "The percentage (0-100) of requests that should be failed with a random error."
+    },
+    "retryAfterInSeconds": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "The number of seconds to set in the Retry-After header for throttling responses."
+    }
+  },
+  "additionalProperties": false
+}
\ No newline at end of file
diff --git a/schemas/v3.3.1/hargeneratorplugin.schema.json b/schemas/v3.3.1/hargeneratorplugin.schema.json
new file mode 100644
index 000000000..a7aa5b5e9
--- /dev/null
+++ b/schemas/v3.3.1/hargeneratorplugin.schema.json
@@ -0,0 +1,20 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy HarGeneratorPlugin config schema",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "Reference to the JSON schema definition."
+    },
+    "includeSensitiveInformation": {
+      "type": "boolean",
+      "description": "Determines whether to include sensitive information (such as authentication headers, and cookies) in the generated HAR file. When set to false, sensitive information will be redacted. Default: false."
+    },
+    "includeResponse": {
+      "type": "boolean",
+      "description": "Determines whether to include HTTP response body in the generated HAR file. When set to false, only request information will be included. Default: false."
+    }
+  },
+  "additionalProperties": false
+}
diff --git a/schemas/v3.3.1/httpfilegeneratorplugin.schema.json b/schemas/v3.3.1/httpfilegeneratorplugin.schema.json
new file mode 100644
index 000000000..f25784f1c
--- /dev/null
+++ b/schemas/v3.3.1/httpfilegeneratorplugin.schema.json
@@ -0,0 +1,16 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy HttpFileGeneratorPlugin config schema",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "Reference to the JSON schema definition."
+    },
+    "includeOptionsRequests": {
+      "type": "boolean",
+      "description": "Determines whether to include OPTIONS requests in the generated HTTP file. Default: false."
+    }
+  },
+  "additionalProperties": false
+}
\ No newline at end of file
diff --git a/schemas/v3.3.1/languagemodelfailureplugin.schema.json b/schemas/v3.3.1/languagemodelfailureplugin.schema.json
new file mode 100644
index 000000000..db6dc115f
--- /dev/null
+++ b/schemas/v3.3.1/languagemodelfailureplugin.schema.json
@@ -0,0 +1,19 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy LanguageModelFailurePlugin config schema",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "The JSON schema reference for validation."
+    },
+    "failures": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "description": "Array of failure types to simulate in language model responses. If not specified, uses default failure types including AmbiguityVagueness, BiasStereotyping, CircularReasoning, ContradictoryInformation, FailureDisclaimHedge, FailureFollowInstructions, Hallucination, IncorrectFormatStyle, Misinterpretation, OutdatedInformation, OverSpecification, OverconfidenceUncertainty, Overgeneralization, OverreliancePriorConversation, and PlausibleIncorrect."
+    }
+  },
+  "additionalProperties": false
+}
\ No newline at end of file
diff --git a/schemas/v3.3.1/languagemodelratelimitingplugin.customresponsefile.schema.json b/schemas/v3.3.1/languagemodelratelimitingplugin.customresponsefile.schema.json
new file mode 100644
index 000000000..248f2dbe1
--- /dev/null
+++ b/schemas/v3.3.1/languagemodelratelimitingplugin.customresponsefile.schema.json
@@ -0,0 +1,48 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy LanguageModelRateLimitingPlugin response",
+  "description": "Mock for the Dev Proxy LanguageModelRateLimitingPlugin",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "The URL of the JSON schema used to validate this custom response file."
+    },
+    "body": {
+      "type": [
+        "object",
+        "array",
+        "string",
+        "number",
+        "boolean"
+      ],
+      "description": "The body of the custom response returned when the token limit is exceeded. Can be an object, array, string, number, or boolean."
+    },
+    "statusCode": {
+      "type": "integer",
+      "description": "HTTP status code to return when the token limit is exceeded (e.g., 429)."
+    },
+    "headers": {
+      "type": "array",
+      "description": "List of headers to include in the custom response.",
+      "items": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "Header name."
+          },
+          "value": {
+            "type": "string",
+            "description": "Header value. Use '@dynamic' for the Retry-After header to automatically calculate seconds until reset."
+          }
+        },
+        "required": [
+          "name",
+          "value"
+        ]
+      }
+    }
+  },
+  "additionalProperties": true
+}
diff --git a/schemas/v3.3.1/languagemodelratelimitingplugin.schema.json b/schemas/v3.3.1/languagemodelratelimitingplugin.schema.json
new file mode 100644
index 000000000..1cc836bb4
--- /dev/null
+++ b/schemas/v3.3.1/languagemodelratelimitingplugin.schema.json
@@ -0,0 +1,43 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy LanguageModelRateLimitingPlugin config schema",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "The URL of the JSON schema used to validate this configuration file."
+    },
+    "headerRetryAfter": {
+      "type": "string",
+      "description": "Name of the response header that communicates the retry-after period (e.g., 'Retry-After')."
+    },
+    "resetTimeWindowSeconds": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "How long in seconds until the next token limit reset."
+    },
+    "promptTokenLimit": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "Number of prompt tokens allowed per time window."
+    },
+    "completionTokenLimit": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "Number of completion tokens allowed per time window."
+    },
+    "whenLimitExceeded": {
+      "type": "string",
+      "enum": [
+        "Throttle",
+        "Custom"
+      ],
+      "description": "Behavior when the token limit is exceeded: 'Throttle' (default throttling) or 'Custom' (custom response)."
+    },
+    "customResponseFile": {
+      "type": "string",
+      "description": "Path to a file containing a custom error response to use when the token limit is exceeded."
+    }
+  },
+  "additionalProperties": false
+}
diff --git a/schemas/v3.3.1/latencyplugin.schema.json b/schemas/v3.3.1/latencyplugin.schema.json
new file mode 100644
index 000000000..82fdd5c92
--- /dev/null
+++ b/schemas/v3.3.1/latencyplugin.schema.json
@@ -0,0 +1,22 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy LatencyPlugin config schema",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "Reference to the JSON schema definition."
+    },
+    "minMs": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "The minimum amount of delay (in milliseconds) added to a request. Default: 0."
+    },
+    "maxMs": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "The maximum amount of delay (in milliseconds) added to a request. Default: 5000."
+    }
+  },
+  "additionalProperties": false
+}
\ No newline at end of file
diff --git a/schemas/v3.3.1/minimalcsompermissions.types.schema.json b/schemas/v3.3.1/minimalcsompermissions.types.schema.json
new file mode 100644
index 000000000..c212cdb5c
--- /dev/null
+++ b/schemas/v3.3.1/minimalcsompermissions.types.schema.json
@@ -0,0 +1,58 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "SharePoint CSOM Types and Permissions Schema",
+  "description": "Schema for defining SharePoint CSOM types, return types, and their required permissions",
+  "type": "object",
+  "required": ["types", "returnTypes", "actions"],
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "Reference to the JSON schema definition."
+    },
+    "types": {
+      "type": "object",
+      "description": "Mapping of GUIDs to their corresponding SharePoint CSOM types. Used for readability and easier mapping.",
+      "patternProperties": {
+        "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$": {
+          "type": "string",
+          "description": "Fully qualified name of a SharePoint CSOM type."
+        }
+      }
+    },
+    "returnTypes": {
+      "type": "object",
+      "description": "Mapping of method signatures to their return types. Used to traverse the CSOM API hierarchy.",
+      "patternProperties": {
+        "^[A-Za-z0-9.]+\\.[A-Za-z0-9.]+$": {
+          "type": "string",
+          "description": "Fully qualified name of the return type."
+        }
+      }
+    },
+    "actions": {
+      "type": "object",
+      "description": "Mapping of method signatures to their required permissions. Each action lists the delegated and application permissions needed, sorted by least privilege first.",
+      "patternProperties": {
+        "^[A-Za-z0-9.]+\\.[A-Za-z0-9.]+$": {
+          "type": "object",
+          "properties": {
+            "delegated": {
+              "type": "array",
+              "description": "Required delegated permissions.",
+              "items": {
+                "type": "string"
+              }
+            },
+            "application": {
+              "type": "array",
+              "description": "Required application permissions.",
+              "items": {
+                "type": "string"
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/schemas/v3.3.1/minimalcsompermissionsplugin.schema.json b/schemas/v3.3.1/minimalcsompermissionsplugin.schema.json
new file mode 100644
index 000000000..f4b3eba17
--- /dev/null
+++ b/schemas/v3.3.1/minimalcsompermissionsplugin.schema.json
@@ -0,0 +1,16 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy MinimalCsomPermissionsPlugin config schema",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "Reference to the JSON schema definition."
+    },
+    "typesFilePath": {
+      "type": "string",
+      "description": "Path to the file that lists permissions required to call SharePoint CSOM APIs. Default: ~appFolder/config/spo-csom-types.json."
+    }
+  },
+  "additionalProperties": false
+}
\ No newline at end of file
diff --git a/schemas/v3.3.1/minimalpermissionsguidanceplugin.schema.json b/schemas/v3.3.1/minimalpermissionsguidanceplugin.schema.json
new file mode 100644
index 000000000..967657c77
--- /dev/null
+++ b/schemas/v3.3.1/minimalpermissionsguidanceplugin.schema.json
@@ -0,0 +1,31 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy MinimalPermissionsGuidancePlugin config schema",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "The JSON schema reference for validation."
+    },
+    "apiSpecsFolderPath": {
+      "type": "string",
+      "description": "Relative or absolute path to the folder with API specs. Used to compare JWT token permissions against minimal required scopes."
+    },
+    "permissionsToExclude": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "description": "The scopes to ignore and not include in the report. Default: ['profile', 'openid', 'offline_access', 'email'].",
+      "default": ["profile", "openid", "offline_access", "email"]
+    },
+    "schemeName": {
+      "type": "string",
+      "description": "The name of the security scheme definition. Used to determine minimal permissions required for API calls."
+    }
+  },
+  "required": [
+    "apiSpecsFolderPath"
+  ],
+  "additionalProperties": false
+}
\ No newline at end of file
diff --git a/schemas/v3.3.1/minimalpermissionsplugin.schema.json b/schemas/v3.3.1/minimalpermissionsplugin.schema.json
new file mode 100644
index 000000000..84d1d24d1
--- /dev/null
+++ b/schemas/v3.3.1/minimalpermissionsplugin.schema.json
@@ -0,0 +1,23 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy MinimalPermissionsPlugin config schema",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "The JSON schema reference for validation."
+    },
+    "apiSpecsFolderPath": {
+      "type": "string",
+      "description": "Relative or absolute path to the folder with API specs. Used to determine minimal permissions required for API calls."
+    },
+    "schemeName": {
+      "type": "string",
+      "description": "The name of the security scheme definition. Used to determine minimal permissions required for API calls."
+    }
+  },
+  "required": [
+    "apiSpecsFolderPath"
+  ],
+  "additionalProperties": false
+}
\ No newline at end of file
diff --git a/schemas/v3.3.1/mockrequestplugin.mockfile.schema.json b/schemas/v3.3.1/mockrequestplugin.mockfile.schema.json
new file mode 100644
index 000000000..e339900e1
--- /dev/null
+++ b/schemas/v3.3.1/mockrequestplugin.mockfile.schema.json
@@ -0,0 +1,77 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy MockRequestPlugin mocks",
+  "description": "Mock request for the Dev Proxy MockRequestPlugin",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "The JSON schema reference for validation."
+    },
+    "request": {
+      "type": "object",
+      "description": "The request to issue.",
+      "properties": {
+        "url": {
+          "type": "string",
+          "format": "uri",
+          "description": "URL to call."
+        },
+        "method": {
+          "type": "string",
+          "enum": [
+            "GET",
+            "POST",
+            "PUT",
+            "PATCH",
+            "DELETE",
+            "HEAD",
+            "OPTIONS",
+            "CONNECT",
+            "TRACE",
+            "QUERY"
+          ],
+          "description": "HTTP method to use (default: POST)."
+        },
+        "body": {
+          "type": [
+            "object",
+            "array",
+            "string",
+            "number",
+            "boolean"
+          ],
+          "description": "Body of the request (object, array, string, number, or boolean)."
+        },
+        "headers": {
+          "type": "array",
+          "description": "Array of request headers (name/value pairs).",
+          "items": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string",
+                "description": "Request header name."
+              },
+              "value": {
+                "type": "string",
+                "description": "Request header value."
+              }
+            },
+            "required": [
+              "name",
+              "value"
+            ]
+          }
+        }
+      },
+      "required": [
+        "url"
+      ]
+    }
+  },
+  "required": [
+    "request"
+  ],
+  "additionalProperties": true
+}
\ No newline at end of file
diff --git a/schemas/v3.3.1/mockrequestplugin.schema.json b/schemas/v3.3.1/mockrequestplugin.schema.json
new file mode 100644
index 000000000..08355e537
--- /dev/null
+++ b/schemas/v3.3.1/mockrequestplugin.schema.json
@@ -0,0 +1,19 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy MockRequestPlugin config schema",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "The JSON schema reference for validation."
+    },
+    "mockFile": {
+      "type": "string",
+      "description": "Path to the file containing the mock request."
+    }
+  },
+  "required": [
+    "mockFile"
+  ],
+  "additionalProperties": false
+}
\ No newline at end of file
diff --git a/schemas/v3.3.1/mockresponseplugin.mocksfile.schema.json b/schemas/v3.3.1/mockresponseplugin.mocksfile.schema.json
new file mode 100644
index 000000000..70201ad37
--- /dev/null
+++ b/schemas/v3.3.1/mockresponseplugin.mocksfile.schema.json
@@ -0,0 +1,107 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy MockResponsePlugin mocks",
+  "description": "Mocks for the Dev Proxy MockResponsePlugin",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "The JSON schema reference for validation."
+    },
+    "mocks": {
+      "type": "array",
+      "description": "Array of mock definitions.",
+      "items": {
+        "type": "object",
+        "properties": {
+          "request": {
+            "type": "object",
+            "description": "The request to match.",
+            "properties": {
+              "url": {
+                "type": "string",
+                "description": "The URL to match. Supports wildcards."
+              },
+              "method": {
+                "type": "string",
+                "enum": [
+                  "GET",
+                  "POST",
+                  "PUT",
+                  "PATCH",
+                  "DELETE",
+                  "HEAD",
+                  "OPTIONS",
+                  "CONNECT",
+                  "TRACE",
+                  "QUERY"
+                ],
+                "description": "HTTP method to match."
+              },
+              "nth": {
+                "type": "integer",
+                "description": "(Optional) Match the nth occurrence of the request."
+              },
+              "bodyFragment": {
+                "type": "string",
+                "description": "(Optional) A fragment of the request body to match."
+              }
+            },
+            "required": [
+              "url"
+            ]
+          },
+          "response": {
+            "type": "object",
+            "description": "The response to return.",
+            "properties": {
+              "body": {
+                "type": [
+                  "object",
+                  "array",
+                  "string",
+                  "number",
+                  "boolean"
+                ],
+                "description": "The response body (object, array, string, number, or boolean; strings can reference a file with '@filename')."
+              },
+              "statusCode": {
+                "type": "integer",
+                "description": "HTTP status code to return."
+              },
+              "headers": {
+                "type": "array",
+                "description": "Array of response headers (name/value pairs).",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string",
+                      "description": "Header name."
+                    },
+                    "value": {
+                      "type": "string",
+                      "description": "Header value."
+                    }
+                  },
+                  "required": [
+                    "name",
+                    "value"
+                  ]
+                }
+              }
+            }
+          }
+        },
+        "required": [
+          "request",
+          "response"
+        ]
+      }
+    }
+  },
+  "required": [
+    "mocks"
+  ],
+  "additionalProperties": true
+}
\ No newline at end of file
diff --git a/schemas/v3.3.1/mockresponseplugin.schema.json b/schemas/v3.3.1/mockresponseplugin.schema.json
new file mode 100644
index 000000000..5343240c4
--- /dev/null
+++ b/schemas/v3.3.1/mockresponseplugin.schema.json
@@ -0,0 +1,23 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy MockResponsePlugin config schema",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "The JSON schema reference for validation."
+    },
+    "mocksFile": {
+      "type": "string",
+      "description": "Path to the file containing the mock responses."
+    },
+    "blockUnmockedRequests": {
+      "type": "boolean",
+      "description": "Set to true to return 502 Bad Gateway response for requests that aren't mocked. Default is false."
+    }
+  },
+  "required": [
+    "mocksFile"
+  ],
+  "additionalProperties": false
+}
\ No newline at end of file
diff --git a/schemas/v3.3.1/mockstdioresponseplugin.mocksfile.schema.json b/schemas/v3.3.1/mockstdioresponseplugin.mocksfile.schema.json
new file mode 100644
index 000000000..cfeea3c3f
--- /dev/null
+++ b/schemas/v3.3.1/mockstdioresponseplugin.mocksfile.schema.json
@@ -0,0 +1,69 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy MockStdioResponsePlugin mocks",
+  "description": "Mocks for the Dev Proxy MockStdioResponsePlugin",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "The JSON schema reference for validation."
+    },
+    "mocks": {
+      "type": "array",
+      "description": "Array of stdio mock definitions.",
+      "items": {
+        "type": "object",
+        "properties": {
+          "request": {
+            "type": "object",
+            "description": "The request pattern to match against stdin.",
+            "properties": {
+              "bodyFragment": {
+                "type": "string",
+                "description": "(Optional) A fragment of the stdin body to match (case-insensitive contains). You can specify bodyFragment, bodyRegex, or both; if both are specified, bodyRegex takes precedence. If neither is specified, the mock matches any stdin or is applied immediately on startup."
+              },
+              "bodyRegex": {
+                "type": "string",
+                "description": "(Optional) A regular expression pattern to match against the stdin body (case-insensitive). You can specify bodyRegex, bodyFragment, or both; if both are specified, bodyRegex takes precedence. If neither is specified, the mock matches any stdin or is applied immediately on startup."
+              },
+              "nth": {
+                "type": "integer",
+                "description": "(Optional) Match the nth occurrence. If not specified, matches every occurrence."
+              }
+            }
+          },
+          "response": {
+            "type": "object",
+            "description": "The mock response to return.",
+            "properties": {
+              "stdout": {
+                "type": [
+                  "object",
+                  "array",
+                  "string",
+                  "number",
+                  "boolean"
+                ],
+                "description": "The stdout content to return. Can be an object, array, string, number, or boolean. If a string value starts with @, it's treated as a file path."
+              },
+              "stderr": {
+                "type": [
+                  "object",
+                  "array",
+                  "string",
+                  "number",
+                  "boolean"
+                ],
+                "description": "The stderr content to return. Can be an object, array, string, number, or boolean. If a string value starts with @, it's treated as a file path."
+              }
+            }
+          }
+        }
+      }
+    }
+  },
+  "required": [
+    "mocks"
+  ],
+  "additionalProperties": true
+}
diff --git a/schemas/v3.3.1/mockstdioresponseplugin.schema.json b/schemas/v3.3.1/mockstdioresponseplugin.schema.json
new file mode 100644
index 000000000..42e5ca0e7
--- /dev/null
+++ b/schemas/v3.3.1/mockstdioresponseplugin.schema.json
@@ -0,0 +1,23 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy MockStdioResponsePlugin config schema",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "The JSON schema reference for validation."
+    },
+    "mocksFile": {
+      "type": "string",
+      "description": "Path to the file containing the stdio mock responses."
+    },
+    "blockUnmockedRequests": {
+      "type": "boolean",
+      "description": "Set to true to block stdin requests that aren't mocked. Default is false."
+    }
+  },
+  "required": [
+    "mocksFile"
+  ],
+  "additionalProperties": false
+}
diff --git a/schemas/v3.3.1/openaitelemetryplugin.pricesfile.schema.json b/schemas/v3.3.1/openaitelemetryplugin.pricesfile.schema.json
new file mode 100644
index 000000000..c03e0c1ba
--- /dev/null
+++ b/schemas/v3.3.1/openaitelemetryplugin.pricesfile.schema.json
@@ -0,0 +1,37 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "OpenAI Telemetry Plugin language model prices file schema",
+  "description": "Schema for the language model prices file used by the OpenAI Telemetry plugin.",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "The JSON schema reference for validation."
+    },
+    "prices": {
+      "type": "object",
+      "description": "Map of model names to their pricing information.",
+      "additionalProperties": {
+        "type": "object",
+        "properties": {
+          "input": {
+            "type": "number",
+            "description": "The price per million tokens for input/prompt tokens."
+          },
+          "output": {
+            "type": "number",
+            "description": "The price per million tokens for output/completion tokens."
+          }
+        },
+        "required": [
+          "input",
+          "output"
+        ]
+      }
+    }
+  },
+  "required": [
+    "prices"
+  ],
+  "additionalProperties": true
+}
\ No newline at end of file
diff --git a/schemas/v3.3.1/openaitelemetryplugin.schema.json b/schemas/v3.3.1/openaitelemetryplugin.schema.json
new file mode 100644
index 000000000..13d16e85e
--- /dev/null
+++ b/schemas/v3.3.1/openaitelemetryplugin.schema.json
@@ -0,0 +1,52 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "OpenAI Telemetry Plugin",
+  "description": "Settings for the OpenAI Telemetry plugin which captures OpenAI API calls and emits OpenTelemetry information.",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "The JSON schema reference for validation."
+    },
+    "application": {
+      "type": "string",
+      "description": "The name of the application using the OpenTelemetry plugin.",
+      "default": "default"
+    },
+    "currency": {
+      "type": "string",
+      "description": "The currency used for cost calculations.",
+      "default": "USD"
+    },
+    "environment": {
+      "type": "string",
+      "description": "The environment in which the application is running (e.g., production, staging, development).",
+      "default": "development"
+    },
+    "exporterEndpoint": {
+      "type": "string",
+      "description": "The endpoint of the OpenTelemetry collector to send information to.",
+      "default": "http://localhost:4318"
+    },
+    "includeCompletion": {
+      "type": "boolean",
+      "description": "Whether to include the completion in the OpenTelemetry span. Disable for privacy or security concerns.",
+      "default": true
+    },
+    "includeCosts": {
+      "type": "boolean",
+      "description": "Whether to calculate and include cost information in the spans. Requires prices data.",
+      "default": false
+    },
+    "includePrompt": {
+      "type": "boolean",
+      "description": "Whether to include the prompt in the OpenTelemetry span. Disable for privacy or security concerns.",
+      "default": true
+    },
+    "pricesFile": {
+      "type": "string",
+      "description": "Path to the JSON file containing prices data for language models."
+    }
+  },
+  "additionalProperties": false
+}
diff --git a/schemas/v3.3.1/openapispecgeneratorplugin.schema.json b/schemas/v3.3.1/openapispecgeneratorplugin.schema.json
new file mode 100644
index 000000000..60417b04f
--- /dev/null
+++ b/schemas/v3.3.1/openapispecgeneratorplugin.schema.json
@@ -0,0 +1,46 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy OpenApiSpecGeneratorPlugin config schema",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "The JSON schema reference for validation."
+    },
+    "includeOptionsRequests": {
+      "type": "boolean",
+      "description": "Determines whether to include OPTIONS requests in the generated OpenAPI spec. Default: false."
+    },
+    "ignoreResponseTypes": {
+      "type": "boolean",
+      "description": "Determines whether to ignore response types in the generated OpenAPI spec. Default: false."
+    },
+    "specVersion": {
+      "type": "string",
+      "enum": [
+        "v2_0",
+        "v3_0",
+        "v3_1",
+        "v3_2"
+      ],
+      "description": "Specifies the OpenAPI spec version to generate. Allowed values: 'v2_0', 'v3_0', 'v3_1' or 'v3_2'. Default: 'v3_0'."
+    },
+    "specFormat": {
+      "type": "string",
+      "enum": [
+        "Json",
+        "Yaml"
+      ],
+      "description": "Specifies the format of the generated OpenAPI spec. Allowed values: 'Json' or 'Yaml'. Default: 'Json'."
+    },
+    "includeParameters": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "description": "Defines the list of query string parameters to include in the generated OpenAPI spec, along with their default values. Default: []",
+      "default": []
+    }
+  },
+  "additionalProperties": false
+}
\ No newline at end of file
diff --git a/schemas/v3.3.1/ratelimitingplugin.customresponsefile.schema.json b/schemas/v3.3.1/ratelimitingplugin.customresponsefile.schema.json
new file mode 100644
index 000000000..5f2c88200
--- /dev/null
+++ b/schemas/v3.3.1/ratelimitingplugin.customresponsefile.schema.json
@@ -0,0 +1,48 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy RateLimitingPlugin response",
+  "description": "Mock for the Dev Proxy RateLimitingPlugin",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "The URL of the JSON schema used to validate this custom response file."
+    },
+    "body": {
+      "type": [
+        "object",
+        "array",
+        "string",
+        "number",
+        "boolean"
+      ],
+      "description": "The body of the custom response returned when the rate limit is exceeded. Can be an object, array, string, number, or boolean."
+    },
+    "statusCode": {
+      "type": "integer",
+      "description": "HTTP status code to return when the rate limit is exceeded (e.g., 403)."
+    },
+    "headers": {
+      "type": "array",
+      "description": "List of headers to include in the custom response.",
+      "items": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "Header name."
+          },
+          "value": {
+            "type": "string",
+            "description": "Header value."
+          }
+        },
+        "required": [
+          "name",
+          "value"
+        ]
+      }
+    }
+  },
+  "additionalProperties": true
+}
\ No newline at end of file
diff --git a/schemas/v3.3.1/ratelimitingplugin.schema.json b/schemas/v3.3.1/ratelimitingplugin.schema.json
new file mode 100644
index 000000000..62b1422ab
--- /dev/null
+++ b/schemas/v3.3.1/ratelimitingplugin.schema.json
@@ -0,0 +1,69 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy RateLimitingPlugin config schema",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "The URL of the JSON schema used to validate this configuration file."
+    },
+    "headerLimit": {
+      "type": "string",
+      "description": "Name of the response header that communicates the rate-limiting limit (e.g., 'RateLimit-Limit')."
+    },
+    "headerRemaining": {
+      "type": "string",
+      "description": "Name of the response header that communicates the remaining number of resources before the reset (e.g., 'RateLimit-Remaining')."
+    },
+    "headerReset": {
+      "type": "string",
+      "description": "Name of the response header that communicates the time remaining until the reset (e.g., 'RateLimit-Reset')."
+    },
+    "headerRetryAfter": {
+      "type": "string",
+      "description": "Name of the response header that communicates the retry-after period (e.g., 'Retry-After')."
+    },
+    "costPerRequest": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "How many resources a single request costs."
+    },
+    "resetTimeWindowSeconds": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "How long in seconds until the next rate limit reset."
+    },
+    "warningThresholdPercent": {
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 100,
+      "description": "The percentage of the rate limit after which warning headers are returned."
+    },
+    "rateLimit": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "Number of resources allowed per time window."
+    },
+    "whenLimitExceeded": {
+      "type": "string",
+      "enum": [
+        "Throttle",
+        "Custom"
+      ],
+      "description": "Behavior when the rate limit is exceeded: 'Throttle' (default throttling) or 'Custom' (custom response)."
+    },
+    "resetFormat": {
+      "type": "string",
+      "enum": [
+        "SecondsLeft",
+        "UtcEpochSeconds"
+      ],
+      "description": "Format for the reset header: 'SecondsLeft' (seconds until reset) or 'UtcEpochSeconds' (UTC epoch seconds)."
+    },
+    "customResponseFile": {
+      "type": "string",
+      "description": "Path to a file containing a custom error response to use when the rate limit is exceeded."
+    }
+  },
+  "additionalProperties": false
+}
\ No newline at end of file
diff --git a/schemas/v3.3.1/rc.schema.json b/schemas/v3.3.1/rc.schema.json
new file mode 100644
index 000000000..711021ef6
--- /dev/null
+++ b/schemas/v3.3.1/rc.schema.json
@@ -0,0 +1,210 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy config",
+  "description": "Configuration for Dev Proxy",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "The URL of the JSON schema used to validate this configuration file. Should match the Dev Proxy version."
+    },
+    "apiAllowedOrigins": {
+      "type": "array",
+      "default": [],
+      "uniqueItems": true,
+      "description": "Exact browser origins allowed to call the control API, for example http://127.0.0.1:3000. No wildcards, paths, or trailing slashes. All requests still require the instance bearer token.",
+      "items": {
+        "type": "string",
+        "format": "uri",
+        "pattern": "^https?://[^/*?#@]+$"
+      }
+    },
+    "apiIpAddress": {
+      "type": "string",
+      "default": "127.0.0.1",
+      "description": "API bind IP address, independent of ipAddress. Defaults to 127.0.0.1; use ::1 for IPv6 loopback. Non-loopback bindings require a trusted network; HTTP bearer tokens are not encrypted.",
+      "anyOf": [{ "format": "ipv4" }, { "format": "ipv6" }]
+    },
+    "apiPort": {
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 65535,
+      "description": "Port for the authenticated Dev Proxy API on apiIpAddress, independent of the traffic proxy. Set 0 to let the OS assign an available port."
+    },
+    "asSystemProxy": {
+      "type": "boolean",
+      "description": "Whether to set Dev Proxy as the system proxy."
+    },
+    "filterByHeaders": {
+      "type": "array",
+      "description": "List of headers to filter requests by. Each object specifies a header name and value.",
+      "items": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "Header name to filter by."
+          },
+          "value": {
+            "type": "string",
+            "description": "Header value to filter by."
+          }
+        },
+        "required": [
+          "name",
+          "value"
+        ]
+      }
+    },
+    "ipAddress": {
+      "type": "string",
+      "description": "IP address for Dev Proxy to listen on."
+    },
+    "languageModel": {
+      "type": "object",
+      "description": "Configuration for using a local language model with Dev Proxy.",
+      "properties": {
+        "cacheResponses": {
+          "type": "boolean",
+          "description": "Whether to cache responses from the language model."
+        },
+        "client": {
+          "type": "string",
+          "enum": [
+            "Ollama",
+            "OpenAI"
+          ],
+          "description": "The client to use for the local language model."
+        },
+        "enabled": {
+          "type": "boolean",
+          "description": "Whether the language model integration is enabled."
+        },
+        "model": {
+          "type": "string",
+          "description": "The name of the language model to use."
+        },
+        "url": {
+          "type": "string",
+          "description": "URL of the local language model server."
+        }
+      }
+    },
+    "logLevel": {
+      "type": "string",
+      "enum": [
+        "debug",
+        "information",
+        "warning",
+        "error",
+        "trace"
+      ],
+      "description": "The minimum log level for Dev Proxy output."
+    },
+    "output": {
+      "type": "string",
+      "enum": [
+        "text",
+        "json"
+      ],
+      "description": "Output format. Use 'text' for readable console output (default), or 'json' for structured JSON Lines output suitable for LLMs and agents."
+    },
+    "newVersionNotification": {
+      "type": "string",
+      "enum": [
+        "none",
+        "stable",
+        "beta"
+      ],
+      "description": "Controls notifications about new Dev Proxy versions."
+    },
+    "plugins": {
+      "type": "array",
+      "description": "List of plugins to load. Each object defines a plugin instance.",
+      "items": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "Name of the plugin."
+          },
+          "enabled": {
+            "type": "boolean",
+            "description": "Whether the plugin is enabled."
+          },
+          "pluginPath": {
+            "type": "string",
+            "description": "Path to the plugin DLL."
+          },
+          "configSection": {
+            "type": "string",
+            "description": "Name of the configuration section for this plugin instance."
+          },
+          "urlsToWatch": {
+            "type": "array",
+            "description": "List of URL patterns for the plugin to watch.",
+            "items": {
+              "type": "string"
+            }
+          }
+        },
+        "required": [
+          "name",
+          "pluginPath"
+        ]
+      }
+    },
+    "port": {
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 65535,
+      "description": "Port for Dev Proxy to listen on."
+    },
+    "record": {
+      "type": "boolean",
+      "description": "Whether to record requests and responses."
+    },
+    "showSkipMessages": {
+      "type": "boolean",
+      "description": "Show messages for skipped requests."
+    },
+    "urlsToWatch": {
+      "type": "array",
+      "description": "List of URL patterns for Dev Proxy to intercept.",
+      "items": {
+        "type": "string"
+      }
+    },
+    "validateSchemas": {
+      "type": "boolean",
+      "description": "Whether to validate configuration files against their schemas. Only applies to JSON-based configuration files."
+    },
+    "watchPids": {
+      "type": "array",
+      "description": "List of process IDs to watch for network traffic.",
+      "items": {
+        "type": "integer"
+      }
+    },
+    "watchProcessNames": {
+      "type": "array",
+      "description": "List of process names to watch for network traffic.",
+      "items": {
+        "type": "string"
+      }
+    },
+    "showTimestamps": {
+      "type": "boolean",
+      "description": "Show timestamps in log output."
+    },
+    "timeoutSeconds": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "Timeout in seconds for requests passing through Dev Proxy."
+    }
+  },
+  "required": [
+    "plugins"
+  ],
+  "additionalProperties": true
+}
\ No newline at end of file
diff --git a/schemas/v3.3.1/rewriteplugin.rewritesfile.schema.json b/schemas/v3.3.1/rewriteplugin.rewritesfile.schema.json
new file mode 100644
index 000000000..b2cbcdd1f
--- /dev/null
+++ b/schemas/v3.3.1/rewriteplugin.rewritesfile.schema.json
@@ -0,0 +1,50 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy RewritePlugin rewrite rules",
+  "description": "Rewrite rules for the Dev Proxy RewritePlugin",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "The URL of the JSON schema used to validate this rewrite rules file."
+    },
+    "rewrites": {
+      "type": "array",
+      "description": "Array of rewrite rule objects that define the list of rewrite rules the RewritePlugin applies.",
+      "items": {
+        "type": "object",
+        "properties": {
+          "in": {
+            "type": "object",
+            "description": "Pattern to match the incoming request.",
+            "properties": {
+              "url": {
+                "type": "string",
+                "pattern": "^.+$",
+                "description": "Regular expression to match the incoming request URL."
+              }
+            },
+            "required": ["url"]
+          },
+          "out": {
+            "type": "object",
+            "description": "Pattern to rewrite the request.",
+            "properties": {
+              "url": {
+                "type": "string",
+                "pattern": "^.*$",
+                "description": "URL to rewrite the request to. Can use capture groups from the 'in' pattern."
+              }
+            },
+            "required": ["url"]
+          }
+        },
+        "required": ["in", "out"]
+      }
+    }
+  },
+  "required": [
+    "rewrites"
+  ],
+  "additionalProperties": true
+}
\ No newline at end of file
diff --git a/schemas/v3.3.1/rewriteplugin.schema.json b/schemas/v3.3.1/rewriteplugin.schema.json
new file mode 100644
index 000000000..6cf593e96
--- /dev/null
+++ b/schemas/v3.3.1/rewriteplugin.schema.json
@@ -0,0 +1,19 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy RewritePlugin config schema",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "The URL of the JSON schema used to validate this configuration file."
+    },
+    "rewritesFile": {
+      "type": "string",
+      "description": "Path to the file containing rewrite definitions (e.g., 'rewrites.json')."
+    }
+  },
+  "required": [
+    "rewritesFile"
+  ],
+  "additionalProperties": false
+}
\ No newline at end of file
diff --git a/schemas/v3.3.1/typespecgeneratorplugin.schema.json b/schemas/v3.3.1/typespecgeneratorplugin.schema.json
new file mode 100644
index 000000000..db770ca4f
--- /dev/null
+++ b/schemas/v3.3.1/typespecgeneratorplugin.schema.json
@@ -0,0 +1,16 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Dev Proxy TypeSpecGeneratorPlugin config schema",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "The URL of the JSON schema used to validate this configuration file."
+    },
+    "ignoreResponseTypes": {
+      "type": "boolean",
+      "description": "Determines whether to generate types for API responses (false) or to set them to 'string' (true)."
+    }
+  },
+  "additionalProperties": false
+}
\ No newline at end of file
diff --git a/schemas/v4.0.0/rc.schema.json b/schemas/v4.0.0/rc.schema.json
index 1525d8ee3..e2a4e5d0b 100644
--- a/schemas/v4.0.0/rc.schema.json
+++ b/schemas/v4.0.0/rc.schema.json
@@ -8,11 +8,28 @@
       "type": "string",
       "description": "The URL of the JSON schema used to validate this configuration file. Should match the Dev Proxy version."
     },
+    "apiAllowedOrigins": {
+      "type": "array",
+      "default": [],
+      "uniqueItems": true,
+      "description": "Exact browser origins allowed to call the control API, for example http://127.0.0.1:3000. No wildcards, paths, or trailing slashes. All requests still require the instance bearer token.",
+      "items": {
+        "type": "string",
+        "format": "uri",
+        "pattern": "^https?://[^/*?#@]+$"
+      }
+    },
+    "apiIpAddress": {
+      "type": "string",
+      "default": "127.0.0.1",
+      "description": "API bind IP address, independent of ipAddress. Defaults to 127.0.0.1; use ::1 for IPv6 loopback. Non-loopback bindings require a trusted network; HTTP bearer tokens are not encrypted.",
+      "anyOf": [{ "format": "ipv4" }, { "format": "ipv6" }]
+    },
     "apiPort": {
       "type": "integer",
       "minimum": 0,
       "maximum": 65535,
-      "description": "Port for the Dev Proxy API server."
+      "description": "Port for the authenticated Dev Proxy API on apiIpAddress, independent of the traffic proxy. Set 0 to let the OS assign an available port."
     },
     "asSystemProxy": {
       "type": "boolean",
diff --git a/scripts/Dockerfile_local b/scripts/Dockerfile_local
index 8cf61f0c4..3bab86120 100644
--- a/scripts/Dockerfile_local
+++ b/scripts/Dockerfile_local
@@ -44,4 +44,5 @@ WORKDIR /config
 
 USER ${USERNAME}
 
-ENTRYPOINT ["/app/devproxy/devproxy", "--ip-address", "0.0.0.0"]
\ No newline at end of file
+ENV PATH="/app/devproxy:${PATH}"
+ENTRYPOINT ["/app/devproxy/devproxy", "--ip-address", "0.0.0.0", "--api-ip-address", "0.0.0.0"]
\ No newline at end of file
diff --git a/skills/dev-proxy/references/analyze-api-usage.md b/skills/dev-proxy/references/analyze-api-usage.md
index 1a9a98d81..95bf4368f 100644
--- a/skills/dev-proxy/references/analyze-api-usage.md
+++ b/skills/dev-proxy/references/analyze-api-usage.md
@@ -17,19 +17,24 @@ Dev Proxy operates in two phases: intercepting (live) and reporting (after recor
 For CI/CD, use the Dev Proxy API instead of keyboard shortcuts:
 
 ```bash
+TOKEN=$(devproxy api token)
 # Start recording
-curl -X POST http://localhost:8897/proxy \
+curl --noproxy '*' --fail -X POST http://127.0.0.1:8897/proxy \
+  -H "Authorization: Bearer $TOKEN" \
   -H "Content-Type: application/json" \
   -d '{"recording": true}'
 
 # Stop recording
-curl -X POST http://localhost:8897/proxy \
+curl --noproxy '*' --fail -X POST http://127.0.0.1:8897/proxy \
+  -H "Authorization: Bearer $TOKEN" \
   -H "Content-Type: application/json" \
   -d '{"recording": false}'
 ```
 
 Use `--record` to start recording automatically when Dev Proxy starts.
 
+These API examples require Dev Proxy 3.3.1 or later. Set `CI=true` when starting the proxy in CI to suppress automatic token output; explicit `api token` retrieval still works. Disable shell tracing around credentials. With multiple instances, use `api token --pid <PID>` and the API URL reported by `devproxy status`.
+
 ## Plugin Architecture for Analysis
 
 Reporting plugins process captured traffic AFTER recording stops. Reporter plugins format and write reports to files. **Reporter plugins must always come AFTER reporting plugins** in the plugins array.
diff --git a/skills/dev-proxy/references/ci-cd-integration.md b/skills/dev-proxy/references/ci-cd-integration.md
index d8a2a096f..f3a98d222 100644
--- a/skills/dev-proxy/references/ci-cd-integration.md
+++ b/skills/dev-proxy/references/ci-cd-integration.md
@@ -2,6 +2,10 @@
 
 Dev Proxy runs headlessly in CI/CD pipelines to automate API testing — catching shadow APIs, verifying permissions, ensuring production-ready API versions, and validating resilience.
 
+With Dev Proxy 3.3.1 or later, every management API request requires a bearer token. Set `CI=true` in the proxy process to suppress automatic token output, and retrieve credentials explicitly with `devproxy api token`. Keep shell tracing disabled around credentials. For multiple instances, add `--pid <PID>` and use the actual API URL from `devproxy status`.
+
+Use action versions that support the authenticated API. For integrations that have not yet added bearer authentication, use the CLI and authenticated HTTP examples below.
+
 ## GitHub Actions (Recommended)
 
 Use the official [Dev Proxy Actions](https://github.com/marketplace/actions/dev-proxy-actions) for the simplest integration.
@@ -206,7 +210,7 @@ steps:
   - script: npm test
     displayName: Run tests
 
-  - script: curl -X POST http://localhost:8897/proxy/stopProxy
+  - script: ./devproxy/devproxy stop
     displayName: Stop Dev Proxy
 
   - script: |
@@ -251,7 +255,7 @@ steps:
 
   - script: |
       mkdir -p ~/.config/dev-proxy
-      ./devproxy/devproxy --config-file .devproxy/config.json > $(LOG_FILE) 2>&1 &
+      CI=true ./devproxy/devproxy --config-file .devproxy/config.json > $(LOG_FILE) 2>&1 &
       echo "Waiting for Dev Proxy to start..."
       while true; do
         if grep -q "Dev Proxy listening on" $(LOG_FILE); then break; fi
@@ -263,7 +267,9 @@ steps:
       sudo update-ca-certificates
     displayName: Start Dev Proxy
 
-  - script: curl -X POST http://localhost:8897/proxy -H "Content-Type: application/json" -d '{"recording": true}'
+  - script: |
+      TOKEN=$(./devproxy/devproxy api token)
+      curl --noproxy '*' --fail -X POST http://127.0.0.1:8897/proxy -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d '{"recording": true}'
     displayName: Start recording
 
   - script: npm test
@@ -272,10 +278,12 @@ steps:
       http_proxy: http://127.0.0.1:8000
       https_proxy: http://127.0.0.1:8000
 
-  - script: curl -X POST http://localhost:8897/proxy -H "Content-Type: application/json" -d '{"recording": false}'
+  - script: |
+      TOKEN=$(./devproxy/devproxy api token)
+      curl --noproxy '*' --fail -X POST http://127.0.0.1:8897/proxy -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d '{"recording": false}'
     displayName: Stop recording
 
-  - script: curl -X POST http://localhost:8897/proxy/stopProxy
+  - script: ./devproxy/devproxy stop
     displayName: Stop Dev Proxy
 
   - script: |
@@ -307,7 +315,7 @@ bash -c "$(curl -sL https://aka.ms/devproxy/setup.sh)" -- v4.0.0
 
 ```bash
 mkdir -p ~/.config/dev-proxy
-./devproxy/devproxy > devproxy.log 2>&1 &
+CI=true ./devproxy/devproxy > devproxy.log 2>&1 &
 ```
 
 ### 3. Wait for Startup
@@ -337,14 +345,15 @@ export https_proxy=http://127.0.0.1:8000
 ### 6. Control via API
 
 ```bash
+TOKEN=$(./devproxy/devproxy api token)
 # Start recording
-curl -X POST http://localhost:8897/proxy -H "Content-Type: application/json" -d '{"recording": true}'
+curl --noproxy '*' --fail -X POST http://127.0.0.1:8897/proxy -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d '{"recording": true}'
 # Run tests
 npm test
 # Stop recording
-curl -X POST http://localhost:8897/proxy -H "Content-Type: application/json" -d '{"recording": false}'
+curl --noproxy '*' --fail -X POST http://127.0.0.1:8897/proxy -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d '{"recording": false}'
 # Stop proxy
-curl -X POST http://localhost:8897/proxy/stopProxy
+./devproxy/devproxy stop
 ```
 
 ### 7. Wait for Completion
@@ -367,7 +376,7 @@ done
 | `/proxy/mockRequest` | POST | Trigger mock request (equivalent of pressing `w`) |
 | `/proxy/rootCertificate?format=crt` | GET | Download root cert in PEM format |
 
-Swagger: `http://localhost:8897/swagger`
+Run `devproxy api show` for endpoint information. All endpoints require `Authorization: Bearer <token>`; browser origins must also be explicitly allowed with `apiAllowedOrigins`.
 
 ## Environment Variables for Azure API Center
 
@@ -393,7 +402,7 @@ LOG_FILE=${LOG_FILE:-devproxy.log}
 CONFIG_FILE=${CONFIG_FILE:-.devproxy/devproxyrc.json}
 
 mkdir -p ~/.config/dev-proxy
-./devproxy/devproxy --config-file "$CONFIG_FILE" > "$LOG_FILE" 2>&1 &
+CI=true ./devproxy/devproxy --config-file "$CONFIG_FILE" > "$LOG_FILE" 2>&1 &
 
 while true; do
   if grep -q "Dev Proxy listening on" "$LOG_FILE"; then break; fi
@@ -417,7 +426,7 @@ set -e
 
 LOG_FILE=${LOG_FILE:-devproxy.log}
 
-curl -s -X POST http://localhost:8897/proxy/stopProxy
+./devproxy/devproxy stop
 
 while true; do
   if grep -q -e "DONE" -e "No requests to process" -e "An error occurred in a plugin" "$LOG_FILE"; then break; fi
diff --git a/skills/dev-proxy/references/configuration.md b/skills/dev-proxy/references/configuration.md
index 38a56390e..31cf5678b 100644
--- a/skills/dev-proxy/references/configuration.md
+++ b/skills/dev-proxy/references/configuration.md
@@ -127,7 +127,9 @@ Plugin-specific override:
 | Setting | Default | CLI flag | Description |
 |---------|---------|----------|-------------|
 | `port` | `8000` | `-p` | Proxy listening port |
-| `apiPort` | `8897` | `--api-port` | Dev Proxy API port |
+| `apiPort` | `8897` | `--api-port` | API port; `0` lets the OS assign an available port |
+| `apiIpAddress` | `127.0.0.1` | `--api-ip-address` | API bind address, independent of `ipAddress`; use `::1` for IPv6 loopback |
+| `apiAllowedOrigins` | `[]` | - | Exact HTTP/HTTPS browser origins allowed to call the API; bearer authentication is still required |
 | `rate` | `50` | `-f` | Failure rate (0-100) |
 | `logLevel` | `information` | `--log-level` | Log verbosity |
 | `record` | off | `--record` | Start in recording mode |
@@ -137,6 +139,35 @@ Plugin-specific override:
 | — | off | `--detach` | Run in detached (background) mode |
 | — | `text` | `--output` | Output format: `text` or `json` |
 
+## API Authentication and Binding
+
+Every API request requires `Authorization: Bearer <token>`. Startup and `devproxy status` show the per-process token in text and JSON, including redirected output and daemon logs. Tokens survive configuration reloads but change on process restart.
+
+When the `CI` environment variable is set, automatic token output is suppressed. Explicit retrieval remains available:
+
+```bash
+TOKEN=$(devproxy api token)
+curl --noproxy '*' --fail http://127.0.0.1:8897/proxy -H "Authorization: Bearer $TOKEN"
+```
+
+For multiple instances, select one with `devproxy api token --pid <PID>`. Use `devproxy status --output json` to discover its actual API URL, especially with `--api-port 0`. Status emits one JSONL `result` per instance, with `pid`, `apiUrl`, `token`, `apiStatus` and instance details. The token is omitted in CI; `apiStatus` distinguishes `available`, `unauthorized`, `invalidCredentials`, and `unavailable`. An empty result has `running: false`.
+
+Status exits with `0` when a matching running instance is found, even if its API cannot be queried, and `1` when none is found. Check the diagnostic or `apiStatus` field for API availability and authentication failures.
+
+Browser access is disabled by default. Set `apiAllowedOrigins` to exact origins such as `http://127.0.0.1:3000`, without paths, wildcards, or trailing slashes. Origins do not replace authentication.
+
+The API uses one listener on `apiIpAddress`, defaulting to `127.0.0.1`. Set `::1` for IPv6 loopback or a specific interface address for network access. `status` and `stop` use that instance's recorded API address; wildcard bindings (`0.0.0.0` or `::`) are mapped to the corresponding loopback address for local commands. Off-loopback startup logs a warning: HTTP sends bearer tokens without encryption, so use a trusted network or a secure tunnel.
+
+### Containers
+
+The shipped images use `--api-ip-address 0.0.0.0`. Publish the API on the host loopback, for example `-p 127.0.0.1:8897:8897`, unless remote access is intentional. Retrieve the running container's token from the host:
+
+```bash
+docker exec <container> devproxy api token
+```
+
+For the beta image, use `devproxy-beta` instead of `devproxy`. Add `--pid <PID>` when the container has multiple instances.
+
 ## Local Language Model
 
 Enable a local LLM (e.g., Ollama) to improve AI-powered plugins:
@@ -165,7 +196,7 @@ Detached mode runs Dev Proxy in the background as a separate process. Use it for
 devproxy --detach
 ```
 
-Output includes PID, proxy URL, API URL, and log file path:
+Output includes PID, proxy URL, API URL, token (outside CI), and log file path:
 
 ```text
 Dev Proxy started in background.
@@ -173,6 +204,7 @@ Dev Proxy started in background.
   PID:       6456
   Proxy URL: http://127.0.0.1:8000
   API URL:   http://127.0.0.1:8897
+  API token: <session-token>
   Log file:  /Users/user/.local/dev-proxy/logs/devproxy-6456-2026-03-05.log
 ```
 
@@ -183,7 +215,7 @@ devproxy --detach --output json
 ```
 
 ```json
-{"type":"result","data":{"pid":6456,"proxyUrl":"http://127.0.0.1:8000","apiUrl":"http://127.0.0.1:8897","logFile":"/Users/user/.local/dev-proxy/logs/devproxy-6456-2026-03-05.log"},"timestamp":"2026-03-05T14:22:42.0000000Z"}
+{"type":"result","data":{"pid":6456,"proxyUrl":"http://127.0.0.1:8000","apiUrl":"http://127.0.0.1:8897","token":"<session-token>","logFile":"/Users/user/.local/dev-proxy/logs/devproxy-6456-2026-03-05.log"},"timestamp":"2026-03-05T14:22:42.0000000Z"}
 ```
 
 ### Common Detached Mode Patterns
diff --git a/tests/devproxy-api.http b/tests/devproxy-api.http
index ed883e549..6580fb5d2 100644
--- a/tests/devproxy-api.http
+++ b/tests/devproxy-api.http
@@ -1,8 +1,13 @@
-GET http://localhost:8897/proxy
+@apiUrl = http://127.0.0.1:8897
+@apiToken = {{$processEnv DEVPROXY_API_TOKEN}}
+
+GET {{apiUrl}}/proxy
+Authorization: Bearer {{apiToken}}
 
 ###
 
-POST http://localhost:8897/proxy
+POST {{apiUrl}}/proxy
+Authorization: Bearer {{apiToken}}
 content-type: application/json
 
 {
@@ -11,7 +16,8 @@ content-type: application/json
 
 ###
 
-POST http://localhost:8897/proxy
+POST {{apiUrl}}/proxy
+Authorization: Bearer {{apiToken}}
 content-type: application/json
 
 {
@@ -20,8 +26,10 @@ content-type: application/json
 
 ###
 
-POST http://localhost:8897/proxy/raiseMockRequest
+POST {{apiUrl}}/proxy/mockRequest
+Authorization: Bearer {{apiToken}}
 
 ###
 
-POST http://localhost:8897/proxy/stopProxy
+POST {{apiUrl}}/proxy/stopProxy
+Authorization: Bearer {{apiToken}}